{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/ion-dtn-2.2.1b-through-4.2.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:nasa:ion-dtn:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-124001"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["ION-DTN (2.2.1b through 4.2.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["NASA"],"content_html":"\u003cp\u003eNASA JPL ION-DTN versions 2.2.1b through 4.2.0 contain an integer overflow vulnerability in the Datagram Retransmission (DGR) convergence layer. An attacker can supply a crafted 64-bit svcDataLength value that wraps during a 32-bit allocation size calculation. This leads to an out-of-bounds heap write during the dgr_receive API memcpy operation.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for denial of service (process crash) or potential remote code execution on systems processing DGR traffic.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to a patched version of ION-DTN once released by the NASA JPL maintainers.\u003c/li\u003e\n\u003cli\u003eUntil patched, restrict access to the DGR convergence layer by isolating internal IPC or custom transport endpoints to trusted network segments only.\u003c/li\u003e\n\u003cli\u003eMonitor service stability for frequent, unexpected restarts of the ION-DTN process, which may indicate crash-based denial of service attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-09T19:51:51Z","date_published":"2026-11-09T19:51:51Z","id":"https://feed.craftedsignal.io/briefs/2026-11-nasa-jpl-ion-dtn-overflow-89345e21/","summary":"NASA JPL ION-DTN versions 2.2.1b through 4.2.0 contain an integer overflow vulnerability in the DGR convergence layer that allows remote code execution via heap memory corruption.","title":"NASA JPL ION-DTN: Datagram Retransmission layer heap corruption (CVE-2026-124001)","url":"https://feed.craftedsignal.io/briefs/2026-11-nasa-jpl-ion-dtn-overflow-89345e21/"}],"language":"en","title":"CraftedSignal Threat Feed - ION-DTN (2.2.1b Through 4.2.0)","version":"https://jsonfeed.org/version/1.1"}