CVE-2026-75584: Nasa-Jpl Ion-Dtn

High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days.

ION-DTN before 4.2.1-a.1 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash the ION process by sending a BPv7 bundle with a zero-length payload. The canonicalizePayloadBlock() function in bpsec_util.c passes bundle->payload.length to zco_clone() without validating it against zero, causing a failed CHKZERO assertion that triggers sm_Abort() and terminates the process with SIGABRT before any HMAC verification occurs, requiring no valid key or credential to exploit.

Affected products

• Nasa-Jpl Ion-Dtn: up to and including 4.2.0

Published 2026-09-10. Last modified 2026-09-18.