ION-DTN 3.6.2-4.2.0 Heap Buffer Overflow via nm_mgr AMP Rendering
Affects ION-DTN 3.6.2 through 4.2.0 in the nm_mgr AMP path, including when file or parsed-report logging is enabled. Fixed in 4.2.1-a.2.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 4.2.1-a.2
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Affects NASA JPL ION-DTN versions 3.6.2 through 4.2.0. Remote path is reachable via the UDP CLA/AMP path when opt-in file or parsed-report logging (-l -r) is enabled. Local path is reachable through interactive UI rendering, even when logging is disabled.
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 21/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
NASA JPL's ION-DTN software has a heap buffer overflow in its nm_mgr Network Management daemon that lets an attacker crash the daemon, halting telemetry collection and operator visibility. The flaw is reached remotely over the network, without logging in, by sending oversized or deeply nested AMP payloads.
Read the original description
NASA JPL ION-DTN 3.6.2 through 4.2.0 contains a heap-based buffer overflow in the Network Management daemon (nm_mgr) string-formatting logic that allows a malicious or misconfigured agent to trigger an out-of-bounds write by sending deeply nested AMP payloads that exceed fixed-size buffer allocations through unbounded strcat operations. Attackers can transmit oversized AMP reports, tables, or macros over the UDP CLA/AMP path or trigger the flaw locally via interactive UI rendering to crash nm_mgr and cause a denial of service halting telemetry collection and operator visibility.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure12/25Specific setups only, reachable over the network without a login
- Reach?/20Unknown. No tracked technology or package matched
- Severity8.7/10CVSS 8.7
- No patch0/5No signal
What would change the score
- Would score about 71 if added to CISA KEV
- Would score about 66 if CISA's SSVC rates exploitation active
What to do
Check whether your setup matches what the bug needs.
Affects NASA JPL ION-DTN versions 3.6.2 through 4.2.0. Remote path is reachable via the UDP CLA/AMP path when opt-in file or parsed-report logging (-l -r) is enabled. Local path is reachable through interactive UI rendering, even when logging is disabled.Upgrade to a fixed version: 4.2.1-a.2.
Workaround: Disable file logging and parsed-report logging (-l -r) if they are not strictly required.
Timeline
- CVE published
- Record last updated
- First seen by cve.now
Affected versions
- nasa-jpl ION-DTN
From 3.6.2 · through 4.2.0
Evidence 3
- Advisory
- Patch
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-123999
Is CVE-2026-123999 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
The bug is a heap-based buffer overflow in how nm_mgr renders AMP data. It can crash the nm_mgr daemon, which halts telemetry collection and operator visibility.Source: vulncheck.com, github.com, github.com
Which versions are affected by CVE-2026-123999?
ION-DTN: from 3.6.2 through 4.2.0.Source: cve.now feed data
Am I affected, and how do I check?
Versions 3.6.2 through 4.2.0 are affected. The UDP CLA/AMP path is reachable when opt-in file or parsed-report logging (-l -r) is enabled, and the interactive UI rendering path is reachable even with logging disabled. To check, look at the installed ION-DTN version and whether nm_mgr is started with -l -r.Source: vulncheck.com, github.com, github.com
How do I fix CVE-2026-123999?
Upgrade to 4.2.1-a.2 or later, which contains the fix. Until then, disable file logging and parsed-report logging (-l -r) if they are not strictly required.Source: vulncheck.com, github.com, github.com