It affects versions 2.2.1b through 4.2.0 and is fixed in 4.2.1-a.2.A 64-bit service-data length can wrap a 32-bit allocation calculation. A second missing capacity check can then permit an out-of-bounds write, causing denial of service or potential code execution.
What it allows
How Does CVE-2026-124001 Corrupt ION-DTN Memory?
The DGR parser accepts a 64-bit service-data length but previously calculated allocation size without checking the 32-bit limit. A crafted value can therefore produce a smaller heap allocation than the declared content requires.
The receiving function then trusted the parsed content length during its memory copy. When the declared size exceeds the destination capacity, the two flaws combine into an out-of-bounds write.
The vendor says standard UDP deployments were largely protected from remote exploitation by network read limits. Local or synthetic datagrams can bypass those constraints, while internal IPC and custom transports face higher exposure.
Successful triggering can corrupt heap memory and stop the service. The advisory also describes potential code execution, but does not claim observed exploitation.
Who is affected
NASA JPL's advisory identifies ION-DTN versions 2.2.1b through 4.2.0 as affected. Version 4.2.1-a.2 contains the fix.
Risk depends on how DGR traffic reaches the receiver. Standard UDP deployments have practical datagram limits, while local input, synthetic datagrams, internal IPC, and custom transports may bypass those limits.
What to do
-
Upgrade to ION-DTN 4.2.1-a.2 or later
Replace versions 2.2.1b through 4.2.0 with the patched release. Verify the running version after maintenance and rebuild dependent components when the deployment process requires it.
-
Inventory every DGR transport path
Identify deployments that accept DGR data through standard UDP, internal IPC, custom transports, or locally generated datagrams. Prioritize paths that can bypass ordinary UDP read limits.
-
Restrict untrusted input during remediation
Brandefense recommends limiting DGR input to trusted peers and processes until upgrades finish. Apply network and local access controls appropriate to each transport path.
-
Review crash and memory-corruption signals
Brandefense recommends checking service restarts, abnormal termination, allocator errors, and related host telemetry. Preserve evidence and follow the incident response plan when suspicious failures appear.
-
Validate the hardened receiver behavior
Confirm the patched receiver rejects service data that exceeds the received datagram or destination capacity. Use approved internal testing that does not reproduce public exploit instructions.
What Brandefense can do
- Scan your domain in Brandefense Atlas, free
Atlas checks public sources for leaked credentials, phishing domains, dark web mentions and data sales, then gives your domain a risk grade. Free, no sign-up.
- Vulnerability Intelligence
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
What is CVE-2026-124001?
It is an integer-overflow and out-of-bounds-write vulnerability in NASA JPL ION-DTN's Datagram Retransmission convergence layer. It can cause denial of service or potential code execution.
Which ION-DTN versions are affected by CVE-2026-124001?
NASA JPL identifies versions 2.2.1b through 4.2.0 as affected. The vulnerability is fixed in ION-DTN 4.2.1-a.2.
Can CVE-2026-124001 be exploited over standard UDP?
The vendor says standard UDP deployments were largely protected by network read limits. Higher-risk paths include local or synthetic datagrams, internal IPC, and custom transports.
What is the severity of CVE-2026-124001?
NVD records CVSS 4.0 9.2 Critical from a secondary source. The GitHub advisory and NVD also record CVSS 3.1 8.1 High.
What did ION-DTN 4.2.1-a.2 change?
The fix adds allocation bounds checks, verifies declared data against the received datagram, and requires the receiver to enforce an explicit destination capacity.
