µD3TN: Memory leak and amplification denial-of-service (CVE-2026-121512)
An unauthenticated remote attacker can exploit a vulnerability in µD3TN BPv6 EID reference handling to cause a memory leak and denial-of-service.
CVE search metadata
CVE search record: CVE-2026-121512. Severity: high. CVSS: 7.5. KEV: no. Product: µD3TN. Brief: µD3TN: Memory leak and amplification denial-of-service (CVE-2026-121512). Brief link: https://feed.craftedsignal.io/briefs/2026-11-ud3tn-memory-leak/
CVE search record: CVE-2026-121510. Severity: high. CVSS: 7.5. KEV: no. Product: µD3TN. Brief: µD3TN: Memory leak and amplification denial-of-service (CVE-2026-121512). Brief link: https://feed.craftedsignal.io/briefs/2026-11-ud3tn-memory-leak/
Triage facts
Revision 2- Applicability
- µD3TN
- Evidence
- Unknown
- Severity
- Low
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 2Nov 3, 20:03 UTC
- Vulnerabilities
- 2 CVEs
- Source quality
- B2Likely
Revision history 1 entry · Revision 2
- Revision 2
added coverage for µD3TN
Changed: action_plan, cves, lastmod, references, tags, ttps, updates
Sources: 1
CVE-2026-121512 describes a vulnerability within the BPv6 (Bundle Protocol version 6) EID (Endpoint Identifier) reference handling of the µD3TN software. An unauthenticated remote attacker can trigger a memory leak amplified by the application's processing logic, ultimately leading to a denial-of-service (DoS) condition. No remediation or fixed version information is provided in the current disclosure.
Impact
Successful exploitation results in a denial-of-service condition due to memory exhaustion. The vulnerability allows an unauthenticated attacker to trigger this state remotely.
Recommendation
Identify and inventory all systems running µD3TN. Monitor host memory utilization for anomalous spikes or sustained growth that correlates with incoming BPv6 traffic. As this is a zero-day advisory without a patch, isolate affected instances from untrusted network segments until the vendor provides a security update.
Immediate actions
Inventory all internal instances of µD3TN
Inventory µD3TN deployments across the network
Threat Hunt
Monitor host memory metrics for sustained abnormal increases
Data: Host system memory usage (RSS), Application logs for BPv6 packet processing
Identify systems receiving anomalous BPv6 administrative record traffic
Data: Network traffic logs focusing on BPv6 administrative record headers
Mitigations
Isolate µD3TN instances from untrusted networks until patch is released
CVE-2026-121512
Apply security patches or configuration hardening for µD3TN once available from the vendor
CVE-2026-121510