ION-DTN (2.2.1b Through 4.2.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/ion-dtn-2.2.1b-through-4.2.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 09 Nov 2026 19:51:51 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgNASA JPL ION-DTN: Datagram Retransmission layer heap corruption (CVE-2026-124001)https://feed.craftedsignal.io/briefs/2026-11-nasa-jpl-ion-dtn-overflow-89345e21/Mon, 09 Nov 2026 19:51:51 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-nasa-jpl-ion-dtn-overflow-89345e21/NASA JPL ION-DTN versions 2.2.1b through 4.2.0 contain an integer overflow vulnerability in the DGR convergence layer that allows remote code execution via heap memory corruption.NASA JPL ION-DTN versions 2.2.1b through 4.2.0 contain an integer overflow vulnerability in the Datagram Retransmission (DGR) convergence layer. An attacker can supply a crafted 64-bit svcDataLength value that wraps during a 32-bit allocation size calculation. This leads to an out-of-bounds heap write during the dgr_receive API memcpy operation.

Impact

Successful exploitation allows for denial of service (process crash) or potential remote code execution on systems processing DGR traffic.

Recommendation

  • Upgrade to a patched version of ION-DTN once released by the NASA JPL maintainers.
  • Until patched, restrict access to the DGR convergence layer by isolating internal IPC or custom transport endpoints to trusted network segments only.
  • Monitor service stability for frequent, unexpected restarts of the ION-DTN process, which may indicate crash-based denial of service attempts.
]]>highadvisory