---
id: "CVE-2026-124001"
page: "https://infrastack.ai/live/CVE-2026-124001"
kind: "vulnerability"
aliases: ["CVE-2026-124001"]
title: "NASA ION-DTN: integer overflow in DGR layer lets crafted datagrams corrupt memory"
severity: "critical"
cvss: 9.2
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "ION-DTN", "fixed": ["4.2.1-a.2"], "affected": ">= 2.2.1b, <= 4.2.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["dtn", "ion-dtn", "runtime", "space-networking"]
not_affected_if: ["dgr-disabled", "not-running-ion-dtn"]
published_at: "2026-11-09T19:16:48+00:00"
first_seen_at: "2026-11-09T19:28:14+00:00"
updated_at: "2026-11-09T19:30:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124001", "first_seen_at": "2026-11-09T19:28:14+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-09T19:30:31+00:00"}]
exploit_sources: []
---

# NASA ION-DTN: integer overflow in DGR layer lets crafted datagrams corrupt memory

Link for people: https://infrastack.ai/live/CVE-2026-124001 (this .md is for agents)

NASA JPL ION-DTN, a delay-tolerant networking suite, has an integer overflow in its Datagram Retransmission convergence layer. A crafted 64-bit svcDataLength value wraps a 32-bit allocation, so an unchecked memcpy in dgr_receive writes out of bounds, which can cause denial of service or possibly remote code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:ION-DTN affected >= 2.2.1b, <= 4.2.0 fixed 4.2.1-a.2

## How to check

- Find your ION-DTN version (source tree or package metadata); affected is 2.2.1b through 4.2.0, fixed in 4.2.1-a.2.
- Check whether your ION configuration uses the DGR convergence layer.
- Highest risk: DGR carried over internal IPC, custom transports, or synthetic datagrams. The advisory says standard UDP deployments were largely protected because network read limits cap datagram size.
- Also check any custom code calling dgr_receive: the old API has no buffer capacity argument.

## Fix

Upgrade ION-DTN to 4.2.1-a.2 (ion-open-source-4.2.1-a.2). Fix checks contentLength against INT_MAX before allocation, adds a capacity parameter to dgr_receive, and updates AMS, BP and dgr2file callers.

## Timeline

- 2026-11-09T19:28:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124001
- 2026-11-09T19:30:31+00:00 analyst — GHSA-rcqq-5qmv-7fxp (vendor) read: affected 2.2.1b-4.2.0, patched 4.2.1-a.2; advisory says standard UDP deployments largely protected by read size limits; DGR default exposure not stated. Release page itself has no notes. Exa out of credits, no social search done.

## Documents

- [advisory] Vendor advisory: github.com https://github.com/nasa-jpl/ION-DTN/security/advisories/GHSA-rcqq-5qmv-7fxp
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/ion-dtn-1b-integer-overflow-heap-corruption-via-dgr
- [fix] Release notes: github.com https://github.com/nasa-jpl/ION-DTN/releases/tag/ion-open-source-4.2.1-a.2

## From the sources

NASA JPL ION-DTN 2.2.1b through 4.2.0 contains an integer overflow vulnerability in the Datagram Retransmission (DGR) convergence layer that allows attackers to corrupt heap memory by sending a maliciously crafted 64-bit svcDataLength value that wraps a 32-bit allocation size calculation. Attackers can exploit the dgr_receive API's unchecked memcpy operation using synthetic datagrams or DGR traffic over internal IPC or custom transports to trigger an out-of-bounds write, leading to denial of service or potential remote code execution.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_