NASA JPL ION-DTN: Datagram Retransmission layer heap corruption (CVE-2026-124001)
NASA JPL ION-DTN versions 2.2.1b through 4.2.0 contain an integer overflow vulnerability in the DGR convergence layer that allows remote code execution via heap memory corruption.
CVE search metadata
CVE search record: CVE-2026-124001. Severity: high. CVSS: 8.1. KEV: no. Product: ION-DTN (2.2.1b through 4.2.0). Brief: NASA JPL ION-DTN: Datagram Retransmission layer heap corruption (CVE-2026-124001). Brief link: https://feed.craftedsignal.io/briefs/2026-11-nasa-jpl-ion-dtn-overflow-89345e21/
Triage facts
Revision 1- Applicability
- ION-DTN (2.2.1b through 4.2.0)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 9, 19:51 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Roughly even chance
NASA JPL ION-DTN versions 2.2.1b through 4.2.0 contain an integer overflow vulnerability in the Datagram Retransmission (DGR) convergence layer. An attacker can supply a crafted 64-bit svcDataLength value that wraps during a 32-bit allocation size calculation. This leads to an out-of-bounds heap write during the dgr_receive API memcpy operation.
Impact
Successful exploitation allows for denial of service (process crash) or potential remote code execution on systems processing DGR traffic.
Recommendation
- Upgrade to a patched version of ION-DTN once released by the NASA JPL maintainers.
- Until patched, restrict access to the DGR convergence layer by isolating internal IPC or custom transport endpoints to trusted network segments only.
- Monitor service stability for frequent, unexpected restarts of the ION-DTN process, which may indicate crash-based denial of service attempts.
Immediate actions
Inventory all deployments of ION-DTN and restrict access to DGR convergence layer endpoints.
Threat Hunt
Monitor ION-DTN application logs or system crash dumps for repeated segmentation faults or process crashes within the DGR convergence layer.
Data: Application crash logs, Systemd/syslog service failure events
Mitigations
Apply patch for CVE-2026-124001 once released by NASA JPL.
CVE-2026-124001