CVE-2026-124000 · Infrastructure
NO FIX YET · SEE WHAT TO DO
NASA JPL ION-DTN, a delay-tolerant networking suite, has a heap under-allocation in its Asynchronous Message Service daemon (amsd) affecting versions 2.1.0 through 4.2.0. A rogue or misconfigured peer sending unauthenticated Meta-AMS configuration messages can trigger an out-of-bounds write that crashes the Configuration Server thread, causing denial of service and possibly destabilizing later shared-memory allocations.
first public Nov 7, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running ION-DTN 2.1.0 through 4.2.0 with amsd exposed to peers that send Meta-AMS configuration messages. The sources describe no authentication on those messages, so any peer that can reach the daemon may send them; deployments with no AMS peers may skip it.
Not affected if amsd-not-running, no-ams-peers
Who cares amsd, ion-dtn, self-hosted, space-networking
2.1.0 through 4.2.0amsd is running and reachable from peers that are not fully trusted, unknown if the sources say more4.2.0; the exact fixed version is unknown from the sources givenNASA JPL ION-DTN 2.1.0 through 4.2.0 contains a heap buffer under-allocation vulnerability in the Asynchronous Message Service daemon (amsd) that allows a rogue or misconfigured peer to trigger an out-of-bounds write by sending crafted Meta-AMS (MAMS) configuration management messages that are processed without cryptographic authentication. Attackers can exploit the insufficient buffer size calculation for the internal state-event object to crash the active Configuration Server thread, causing a denial of service and potentially destabilizing subsequent shared-memory allocations in amsd.
This page as ·
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.