{"id":"CVE-2026-124001","kind":"vulnerability","aliases":["CVE-2026-124001"],"related":[],"title":"NASA ION-DTN: integer overflow in DGR layer lets crafted datagrams corrupt memory","description":"NASA JPL ION-DTN 2.2.1b through 4.2.0 contains an integer overflow vulnerability in the Datagram Retransmission (DGR) convergence layer that allows attackers to corrupt heap memory by sending a maliciously crafted 64-bit svcDataLength value that wraps a 32-bit allocation size calculation. Attackers can exploit the dgr_receive API's unchecked memcpy operation using synthetic datagrams or DGR traffic over internal IPC or custom transports to trigger an out-of-bounds write, leading to denial of service or potential remote code execution.","summary":"NASA JPL ION-DTN, a delay-tolerant networking suite, has an integer overflow in its Datagram Retransmission convergence layer. A crafted 64-bit svcDataLength value wraps a 32-bit allocation, so an unchecked memcpy in dgr_receive writes out of bounds, which can cause denial of service or possibly remote code execution.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ION-DTN","fixed":["4.2.1-a.2"],"affected":">= 2.2.1b, <= 4.2.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["dtn","ion-dtn","runtime","space-networking"],"not_affected_if":["dgr-disabled","not-running-ion-dtn"],"how_to_check":"- Find your ION-DTN version (source tree or package metadata); affected is 2.2.1b through 4.2.0, fixed in 4.2.1-a.2.\n- Check whether your ION configuration uses the DGR convergence layer.\n- Highest risk: DGR carried over internal IPC, custom transports, or synthetic datagrams. The advisory says standard UDP deployments were largely protected because network read limits cap datagram size.\n- Also check any custom code calling dgr_receive: the old API has no buffer capacity argument.","fix":"Upgrade ION-DTN to 4.2.1-a.2 (ion-open-source-4.2.1-a.2). Fix checks contentLength against INT_MAX before allocation, adds a capacity parameter to dgr_receive, and updates AMS, BP and dgr2file callers.","status":"open","published_at":"2026-11-09T19:16:48+00:00","first_seen_at":"2026-11-09T19:28:14+00:00","triaged_at":"2026-11-09T19:29:24+00:00","updated_at":"2026-11-09T19:30:31+00:00","category":"runtime","confidence":0.85,"triage":{"at":"2026-11-09T19:29:24Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"NASA ION-DTN: integer overflow in DGR layer lets crafted datagrams corrupt memory","impact":"high","summary":"NASA JPL ION-DTN, a delay-tolerant networking suite, has an integer overflow in its Datagram Retransmission convergence layer. A crafted 64-bit svcDataLength value wraps a 32-bit allocation, so an unchecked memcpy in dgr_receive writes out of bounds, which can cause denial of service or possibly remote code execution.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["ion-dtn","dtn","space-networking"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Heap corruption leads to denial of service or possible code execution","analyst_note":"Confirm the fixed version and the vendor advisory at github.com linked from the sources, and whether DGR is reachable from untrusted networks by default.","how_to_check":"- Check whether ION-DTN is installed and which version it is, for example by looking at the version in the ION source tree or package metadata.\n- Check whether the DGR convergence layer is enabled in your ION configuration.\n- Versions in the affected range: `2.2.1b` through `4.2.0`.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["not-running-ion-dtn","dgr-disabled"],"who_is_affected":"Teams running NASA JPL ION-DTN in the affected range that receive DGR traffic, whether from internal IPC or custom transports. The sources do not say whether the default configuration exposes the DGR layer to untrusted networks. Teams not running ION-DTN can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000792,"input_tokens":4722,"output_tokens":639,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the fixed version and the vendor advisory at github.com linked from the sources, and whether DGR is reachable from untrusted networks by default.","search":"'-124001':17A,20A '-2026':16A,19A '2.2.1':91C '32':61B,126C '4.2.0':94C '64':55B,119C 'alloc':63B,128C 'allow':108C 'api':137C 'attack':109C,131C 'b':92C 'bit':56B,62B,120C,127C 'bound':74B,160C 'calcul':130C 'caus':77B 'code':84B,170C 'contain':95C 'converg':51B,105C 'corrupt':13A,111C 'craft':11A,54B,118C 'custom':152C 'cve':15A,18A 'datagram':12A,49B,102C,144C 'delay':39B 'delay-toler':38B 'denial':78B,164C 'dgr':8A,69B,104C,135C,146C 'dtn':4A,23A,24B,27B,36B,90C 'execut':85B,171C 'exploit':133C 'heap':112C 'integ':5A,45B,97C 'intern':149C 'ion':3A,22A,26B,35B,89C 'ion-dtn':2A,21A,25B,34B,88C 'ipc':150C 'jpl':33B,87C 'layer':9A,52B,106C 'lead':162C 'let':10A 'malici':117C 'memcpi':67B,140C 'memori':14A,113C 'nasa':1A,32B,86C 'network':31B,41B 'oper':141C 'out-of-bound':157C 'overflow':6A,46B,98C 'possibl':82B 'potenti':168C 'receiv':70B,136C 'remot':83B,169C 'retransmiss':50B,103C 'runtim':28B 'send':115C 'servic':80B,166C 'size':129C 'space':30B 'space-network':29B 'suit':42B 'svcdatalength':57B,121C 'synthet':143C 'toler':40B 'traffic':147C 'transport':153C 'trigger':155C 'uncheck':66B,139C 'use':142C 'valu':58B,122C 'vulner':99C 'wrap':59B,124C 'write':71B,161C","nicknames":[],"mitigations":[],"who_affected":"Teams running NASA JPL ION-DTN 2.2.1b through 4.2.0 that use the DGR convergence layer. The advisory says standard UDP deployments were largely protected from remote exploitation by network read limits on datagram size; risk is higher where DGR runs over internal IPC or custom transports, or where synthetic datagrams bypass those limits. The advisory does not say whether DGR is on by default. Teams not running ION-DTN or not using DGR can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-09T19:30:31Z","by":"analyst","doc":"https://github.com/nasa-jpl/ION-DTN/releases/tag/ion-open-source-4.2.1-a.2","run_id":2315},"products":{"at":"2026-11-09T19:30:31Z","by":"analyst","doc":"https://github.com/nasa-jpl/ION-DTN/releases/tag/ion-open-source-4.2.1-a.2","run_id":2315},"how_to_check":{"at":"2026-11-09T19:30:31Z","by":"analyst","doc":"https://github.com/nasa-jpl/ION-DTN/releases/tag/ion-open-source-4.2.1-a.2","run_id":2315},"who_affected":{"at":"2026-11-09T19:30:31Z","by":"analyst","doc":"https://github.com/nasa-jpl/ION-DTN/releases/tag/ion-open-source-4.2.1-a.2","run_id":2315}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["iondtn"],"ptokens":["dtn","ion"],"labels":["critical","dtn","iondtn","runtime","spacenetworking"],"campaign_type":null,"search_a":"'-124001':17A,20A '-2026':16A,19A 'corrupt':13A 'craft':11A 'cve':15A,18A 'datagram':12A 'dgr':8A 'dtn':4A,23A 'integ':5A 'ion':3A,22A 'ion-dtn':2A,21A 'layer':9A 'let':10A 'memori':14A 'nasa':1A 'overflow':6A","search_b":"'32':61B '64':55B 'alloc':63B 'bit':56B,62B 'bound':74B 'caus':77B 'code':84B 'converg':51B 'craft':54B 'datagram':49B 'delay':39B 'delay-toler':38B 'denial':78B 'dgr':69B 'dtn':24B,27B,36B 'execut':85B 'integ':45B 'ion':26B,35B 'ion-dtn':25B,34B 'jpl':33B 'layer':52B 'memcpi':67B 'nasa':32B 'network':31B,41B 'overflow':46B 'possibl':82B 'receiv':70B 'remot':83B 'retransmiss':50B 'runtim':28B 'servic':80B 'space':30B 'space-network':29B 'suit':42B 'svcdatalength':57B 'toler':40B 'uncheck':66B 'valu':58B 'wrap':59B 'write':71B","search_c":"'2.2.1':91C '32':126C '4.2.0':94C '64':119C 'alloc':128C 'allow':108C 'api':137C 'attack':109C,131C 'b':92C 'bit':120C,127C 'bound':160C 'calcul':130C 'code':170C 'contain':95C 'converg':105C 'corrupt':111C 'craft':118C 'custom':152C 'datagram':102C,144C 'denial':164C 'dgr':104C,135C,146C 'dtn':90C 'execut':171C 'exploit':133C 'heap':112C 'integ':97C 'intern':149C 'ion':89C 'ion-dtn':88C 'ipc':150C 'jpl':87C 'layer':106C 'lead':162C 'malici':117C 'memcpi':140C 'memori':113C 'nasa':86C 'oper':141C 'out-of-bound':157C 'overflow':98C 'potenti':168C 'receiv':136C 'remot':169C 'retransmiss':103C 'send':115C 'servic':166C 'size':129C 'svcdatalength':121C 'synthet':143C 'traffic':147C 'transport':153C 'trigger':155C 'uncheck':139C 'use':142C 'valu':122C 'vulner':99C 'wrap':124C 'write':161C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-07T00:28:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124001","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124001","severity":null,"published_at":"2026-11-09T19:16:48+00:00","modified_at":"2026-11-09T19:16:48+00:00","first_seen_at":"2026-11-09T19:28:14+00:00","fetched_at":"2026-11-09T19:28:14+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124001:2315","url":null,"severity":null,"published_at":"2026-11-09T19:30:31+00:00","modified_at":"2026-11-09T19:30:31+00:00","first_seen_at":"2026-11-09T19:30:31+00:00","fetched_at":"2026-11-09T19:30:31+00:00","note":"GHSA-rcqq-5qmv-7fxp (vendor) read: affected 2.2.1b-4.2.0, patched 4.2.1-a.2; advisory says standard UDP deployments largely protected by read size limits; DGR default exposure not stated. Release page itself has no notes. Exa out of credits, no social search done."}],"documents":[{"id":109178,"url":"https://github.com/nasa-jpl/ION-DTN/releases/tag/ion-open-source-4.2.1-a.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":109185,"url":"https://github.com/nasa-jpl/ION-DTN/security/advisories/GHSA-rcqq-5qmv-7fxp","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-07T00:28:36+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":109186,"url":"https://www.vulncheck.com/advisories/ion-dtn-1b-integer-overflow-heap-corruption-via-dgr","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}