{"id":"CVE-2026-123999","kind":"vulnerability","aliases":["CVE-2026-123999"],"related":[],"title":"ION-DTN: heap overflow in network manager daemon crashes telemetry collection","description":"NASA JPL ION-DTN 3.6.2 through 4.2.0 contains a heap-based buffer overflow in the Network Management daemon (nm_mgr) string-formatting logic that allows a malicious or misconfigured agent to trigger an out-of-bounds write by sending deeply nested AMP payloads that exceed fixed-size buffer allocations through unbounded strcat operations. Attackers can transmit oversized AMP reports, tables, or macros over the UDP CLA/AMP path or trigger the flaw locally via interactive UI rendering to crash nm_mgr and cause a denial of service halting telemetry collection and operator visibility.","summary":"NASA JPL ION-DTN versions 3.6.2 through 4.2.0 have a heap buffer overflow in the nm_mgr network management daemon when it handles deeply nested AMP payloads. A malicious or misconfigured agent can send oversized AMP reports over UDP, crashing nm_mgr and halting telemetry and operator visibility.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ION-DTN","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ion-dtn","nasa-jpl","nm_mgr","runtime","space-networking"],"not_affected_if":["nm_mgr-not-running","version-outside-range"],"how_to_check":"- Check the installed ION-DTN version against the affected range `3.6.2` through `4.2.0`.\n- Look for the `nm_mgr` daemon on hosts running ION-DTN and whether its UDP CLA/AMP path is reachable from other networks.","fix":"- Move to a version newer than `4.2.0`; the fixed version is not stated in the sources provided.","status":"open","published_at":"2026-11-09T19:16:47+00:00","first_seen_at":"2026-11-09T19:28:14+00:00","triaged_at":"2026-11-09T19:29:25+00:00","updated_at":"2026-11-09T19:29:25+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-09T19:29:25Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a version newer than `4.2.0`; the fixed version is not stated in the sources provided.","reach":"network","title":"ION-DTN: heap overflow in network manager daemon crashes telemetry collection","impact":"low","summary":"NASA JPL ION-DTN versions 3.6.2 through 4.2.0 have a heap buffer overflow in the nm_mgr network management daemon when it handles deeply nested AMP payloads. A malicious or misconfigured agent can send oversized AMP reports over UDP, crashing nm_mgr and halting telemetry and operator visibility.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["ion-dtn","nasa-jpl","space-networking","nm_mgr"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"nm_mgr crashes, halting telemetry collection and operator visibility","analyst_note":"Confirm the fixed version and fix from the release notes and vendor advisory linked on github.com; the description also says the flaw is a heap overflow with possible code-execution risk, which the sources do not confirm.","how_to_check":"- Check the installed ION-DTN version against the affected range `3.6.2` through `4.2.0`.\n- Look for the `nm_mgr` daemon on hosts running ION-DTN and whether its UDP CLA/AMP path is reachable from other networks.","plain_action":"","product_name":"ION-DTN","needs_analyst":true,"not_affected_if":["version-outside-range","nm_mgr-not-running"],"who_is_affected":"Teams running ION-DTN, the delay-tolerant networking software used for space and remote links, where nm_mgr is started and reachable over the UDP CLA/AMP path or through its interactive UI. Hosts that do not run nm_mgr or that keep the AMP path off untrusted networks are less exposed. The sources do not state a default configuration.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000837,"input_tokens":4745,"output_tokens":725,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123999':15A,18A '-2026':14A,17A '3.6.2':40B,88C '4.2.0':42B,90C 'agent':66B,115C 'alloc':136C 'allow':110C 'amp':60B,70B,128C,145C 'attack':141C 'base':95C 'bound':122C 'buffer':46B,96C,135C 'caus':169C 'cla/amp':153C 'collect':12A,176C 'contain':91C 'crash':10A,74B,165C 'cve':13A,16A 'daemon':9A,54B,102C 'deepli':58B,126C 'denial':171C 'dtn':3A,21A,24B,38B,87C 'exceed':131C 'fix':133C 'fixed-s':132C 'flaw':158C 'format':107C 'halt':78B,174C 'handl':57B 'heap':4A,45B,94C 'heap-bas':93C 'interact':161C 'ion':2A,20A,23B,37B,86C 'ion-dtn':1A,19A,22B,36B,85C 'jpl':27B,35B,84C 'local':159C 'logic':108C 'macro':149C 'malici':63B,112C 'manag':8A,53B,101C 'mgr':29B,51B,76B,104C,167C 'misconfigur':65B,114C 'nasa':26B,34B,83C 'nasa-jpl':25B 'nest':59B,127C 'network':7A,33B,52B,100C 'nm':28B,50B,75B,103C,166C 'oper':81B,140C,178C 'out-of-bound':119C 'overflow':5A,47B,97C 'overs':69B,144C 'path':154C 'payload':61B,129C 'render':163C 'report':71B,146C 'runtim':30B 'send':68B,125C 'servic':173C 'size':134C 'space':32B 'space-network':31B 'strcat':139C 'string':106C 'string-format':105C 'tabl':147C 'telemetri':11A,79B,175C 'transmit':143C 'trigger':117C,156C 'udp':73B,152C 'ui':162C 'unbound':138C 'version':39B 'via':160C 'visibl':82B,179C 'write':123C","nicknames":[],"mitigations":[],"who_affected":"Teams running ION-DTN, the delay-tolerant networking software used for space and remote links, where nm_mgr is started and reachable over the UDP CLA/AMP path or through its interactive UI. Hosts that do not run nm_mgr or that keep the AMP path off untrusted networks are less exposed. The sources do not state a default configuration.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["iondtn"],"ptokens":["dtn","ion"],"labels":["high","iondtn","nasajpl","nmmgr","runtime","spacenetworking","vendor"],"campaign_type":null,"search_a":"'-123999':15A,18A '-2026':14A,17A 'collect':12A 'crash':10A 'cve':13A,16A 'daemon':9A 'dtn':3A,21A 'heap':4A 'ion':2A,20A 'ion-dtn':1A,19A 'manag':8A 'network':7A 'overflow':5A 'telemetri':11A","search_b":"'3.6.2':40B '4.2.0':42B 'agent':66B 'amp':60B,70B 'buffer':46B 'crash':74B 'daemon':54B 'deepli':58B 'dtn':24B,38B 'halt':78B 'handl':57B 'heap':45B 'ion':23B,37B 'ion-dtn':22B,36B 'jpl':27B,35B 'malici':63B 'manag':53B 'mgr':29B,51B,76B 'misconfigur':65B 'nasa':26B,34B 'nasa-jpl':25B 'nest':59B 'network':33B,52B 'nm':28B,50B,75B 'oper':81B 'overflow':47B 'overs':69B 'payload':61B 'report':71B 'runtim':30B 'send':68B 'space':32B 'space-network':31B 'telemetri':79B 'udp':73B 'version':39B 'visibl':82B","search_c":"'3.6.2':88C '4.2.0':90C 'agent':115C 'alloc':136C 'allow':110C 'amp':128C,145C 'attack':141C 'base':95C 'bound':122C 'buffer':96C,135C 'caus':169C 'cla/amp':153C 'collect':176C 'contain':91C 'crash':165C 'daemon':102C 'deepli':126C 'denial':171C 'dtn':87C 'exceed':131C 'fix':133C 'fixed-s':132C 'flaw':158C 'format':107C 'halt':174C 'heap':94C 'heap-bas':93C 'interact':161C 'ion':86C 'ion-dtn':85C 'jpl':84C 'local':159C 'logic':108C 'macro':149C 'malici':112C 'manag':101C 'mgr':104C,167C 'misconfigur':114C 'nasa':83C 'nest':127C 'network':100C 'nm':103C,166C 'oper':140C,178C 'out-of-bound':119C 'overflow':97C 'overs':144C 'path':154C 'payload':129C 'render':163C 'report':146C 'send':125C 'servic':173C 'size':134C 'strcat':139C 'string':106C 'string-format':105C 'tabl':147C 'telemetri':175C 'transmit':143C 'trigger':117C,156C 'udp':152C 'ui':162C 'unbound':138C 'via':160C 'visibl':179C 'write':123C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-07T00:28:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123999","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123999","severity":null,"published_at":"2026-11-09T19:16:47+00:00","modified_at":"2026-11-09T19:16:47+00:00","first_seen_at":"2026-11-09T19:28:14+00:00","fetched_at":"2026-11-09T19:28:14+00:00","note":null}],"documents":[{"id":109178,"url":"https://github.com/nasa-jpl/ION-DTN/releases/tag/ion-open-source-4.2.1-a.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":109179,"url":"https://github.com/nasa-jpl/ION-DTN/security/advisories/GHSA-gmhw-vmwr-wrxh","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-07T00:28:34+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":109180,"url":"https://www.vulncheck.com/advisories/ion-dtn-heap-buffer-overflow-via-nm-mgr-amp-rendering","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}