CVE-2025-61910

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-61910", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-10-03T22:21:59.614Z", "datePublished": "2025-10-07T19:31:33.358Z", "dateUpdated": "2025-10-07T19:57:34.531Z"}, "containers": {"cna": {"title": "NASA ION-DTN BPv7 4.1.3s Uncontrolled Memory Allocation that leads to Denial-of-Service", "problemTypes": [{"descriptions": [{"cweId": "CWE-789", "lang": "en", "description": "CWE-789: Memory Allocation with Excessive Size Value", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/nasa-jpl/ION-DTN/security/advisories/GHSA-xm96-38vj-h28h", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nasa-jpl/ION-DTN/security/advisories/GHSA-xm96-38vj-h28h"}, {"name": "https://github.com/nasa-jpl/ION-DTN/blob/ion-open-source-4.1.3s/bpv7/library/bei.c#L758-L769", "tags": ["x_refsource_MISC"], "url": "https://github.com/nasa-jpl/ION-DTN/blob/ion-open-source-4.1.3s/bpv7/library/bei.c#L758-L769"}], "affected": [{"vendor": "nasa-jpl", "product": "ION-DTN", "versions": [{"version": "= 4.1.3s", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-07T19:31:33.358Z"}, "descriptions": [{"lang": "en", "value": "The NASA\u2019s Interplanetary Overlay Network (ION) is an implementation of Delay/Disruption Tolerant Networking (DTN). A BPv7 bundle with a malformed extension block causes uncontrolled memory allocation inside ION-DTN 4.1.3s, leading to receiver thread termination and a Denial-of-Service (DoS). The triggering bundle contains an extension block starting at `0x85070201005bbb0e20b4ea001a000927c0...`. The first byte in the extension block (0x85) indicates a CBOR array of five elements of which the first four are numbers (0x07, 0x02, 0x01, 0x00) but the fifth element is a byte string of length 27 (`0x5bbb0e20b4ea001a000927c0...`). The vulnerability seems to be due to processing the fifth element of the array (i.e., the byte string) as replacing it with a number makes the vulnerability no longer be triggered. While parsing this extension block, ION obtains a very large block length, which in the code in `bei.c`:764) seems to be passed from `blockLength` which is an unsigned int, to a 32 bit signed integer `blkSize`. The unsigned to signed conversion causes `blkSize` to hold the value of -369092043, which is then converted into a 64-bit unsigned value inside `MTAKE(blkSize)`, resulting in an attempt to allocate an unrealistic amount of memory, causing the error. As of time of publication, no known patched versions of BPv7 exist."}], "source": {"advisory": "GHSA-xm96-38vj-h28h", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-07T19:56:09.913548Z", "id": "CVE-2025-61910", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-07T19:57:34.531Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-61910", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-07T19:56:09.913548Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-07T19:56:12.366Z"}}], "cna": {"title": "NASA ION-DTN BPv7 4.1.3s Uncontrolled Memory Allocation that leads to Denial-of-Service", "source": {"advisory": "GHSA-xm96-38vj-h28h", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "nasa-jpl", "product": "ION-DTN", "versions": [{"status": "affected", "version": "= 4.1.3s"}]}], "references": [{"url": "https://github.com/nasa-jpl/ION-DTN/security/advisories/GHSA-xm96-38vj-h28h", "name": "https://github.com/nasa-jpl/ION-DTN/security/advisories/GHSA-xm96-38vj-h28h", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/nasa-jpl/ION-DTN/blob/ion-open-source-4.1.3s/bpv7/library/bei.c#L758-L769", "name": "https://github.com/nasa-jpl/ION-DTN/blob/ion-open-source-4.1.3s/bpv7/library/bei.c#L758-L769", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "The NASA\u2019s Interplanetary Overlay Network (ION) is an implementation of Delay/Disruption Tolerant Networking (DTN). A BPv7 bundle with a malformed extension block causes uncontrolled memory allocation inside ION-DTN 4.1.3s, leading to receiver thread termination and a Denial-of-Service (DoS). The triggering bundle contains an extension block starting at `0x85070201005bbb0e20b4ea001a000927c0...`. The first byte in the extension block (0x85) indicates a CBOR array of five elements of which the first four are numbers (0x07, 0x02, 0x01, 0x00) but the fifth element is a byte string of length 27 (`0x5bbb0e20b4ea001a000927c0...`). The vulnerability seems to be due to processing the fifth element of the array (i.e., the byte string) as replacing it with a number makes the vulnerability no longer be triggered. While parsing this extension block, ION obtains a very large block length, which in the code in `bei.c`:764) seems to be passed from `blockLength` which is an unsigned int, to a 32 bit signed integer `blkSize`. The unsigned to signed conversion causes `blkSize` to hold the value of -369092043, which is then converted into a 64-bit unsigned value inside `MTAKE(blkSize)`, resulting in an attempt to allocate an unrealistic amount of memory, causing the error. As of time of publication, no known patched versions of BPv7 exist."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-789", "description": "CWE-789: Memory Allocation with Excessive Size Value"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-07T19:31:33.358Z"}}}, "cveMetadata": {"cveId": "CVE-2025-61910", "state": "PUBLISHED", "dateUpdated": "2025-10-07T19:57:34.531Z", "dateReserved": "2025-10-03T22:21:59.614Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-10-07T19:31:33.358Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "ION-DTN", "vendor": "nasa-jpl", "versions": [{"status": "affected", "version": "= 4.1.3s"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The NASA\u2019s Interplanetary Overlay Network (ION) is an implementation of Delay/Disruption Tolerant Networking (DTN). A BPv7 bundle with a malformed extension block causes uncontrolled memory allocation inside ION-DTN 4.1.3s, leading to receiver thread termination and a Denial-of-Service (DoS). The triggering bundle contains an extension block starting at `0x85070201005bbb0e20b4ea001a000927c0...`. The first byte in the extension block (0x85) indicates a CBOR array of five elements of which the first four are numbers (0x07, 0x02, 0x01, 0x00) but the fifth element is a byte string of length 27 (`0x5bbb0e20b4ea001a000927c0...`). The vulnerability seems to be due to processing the fifth element of the array (i.e., the byte string) as replacing it with a number makes the vulnerability no longer be triggered. While parsing this extension block, ION obtains a very large block length, which in the code in `bei.c`:764) seems to be passed from `blockLength` which is an unsigned int, to a 32 bit signed integer `blkSize`. The unsigned to signed conversion causes `blkSize` to hold the value of -369092043, which is then converted into a 64-bit unsigned value inside `MTAKE(blkSize)`, resulting in an attempt to allocate an unrealistic amount of memory, causing the error. As of time of publication, no known patched versions of BPv7 exist."}, {"lang": "es", "value": "La Red de Superposici\u00f3n Interplanetaria (ION) de la NASA es una implementaci\u00f3n de Redes Tolerantes a Retrasos/Interrupciones (DTN). Un paquete BPv7 con un bloque de extensi\u00f3n malformado causa una asignaci\u00f3n de memoria incontrolada dentro de ION-DTN 4.1.3s, lo que lleva a la terminaci\u00f3n del hilo del receptor y a una Denegaci\u00f3n de Servicio (DoS). El paquete desencadenante contiene un bloque de extensi\u00f3n que comienza en '0x85070201005bbb0e20b4ea001a000927c0...'. El primer byte en el bloque de extensi\u00f3n (0x85) indica un array CBOR de cinco elementos de los cuales los primeros cuatro son n\u00fameros (0x07, 0x02, 0x01, 0x00) pero el quinto elemento es una cadena de bytes de longitud 27 ('0x5bbb0e20b4ea001a000927c0...'). La vulnerabilidad parece deberse al procesamiento del quinto elemento del array (es decir, la cadena de bytes) ya que reemplazarlo con un n\u00famero hace que la vulnerabilidad ya no se active. Al analizar este bloque de extensi\u00f3n, ION obtiene una longitud de bloque muy grande, que en el c\u00f3digo en 'bei.c':764) parece ser pasado de 'blockLength' que es un entero sin signo, a un entero con signo de 32 bits 'blkSize'. La conversi\u00f3n de sin signo a con signo hace que 'blkSize' contenga el valor de -369092043, que luego se convierte en un valor sin signo de 64 bits dentro de 'MTAKE(blkSize)', lo que resulta en un intento de asignar una cantidad irreal de memoria, causando el error. A la fecha de publicaci\u00f3n, no existen versiones parcheadas conocidas de BPv7."}], "id": "CVE-2025-61910", "lastModified": "2026-10-08T13:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-61910", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-07T19:56:09.913548Z", "version": "2.0.3"}}]}, "published": "2025-10-07T20:15:35.993", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/nasa-jpl/ION-DTN/blob/ion-open-source-4.1.3s/bpv7/library/bei.c#L758-L769"}, {"source": "security-advisories@github.com", "url": "https://github.com/nasa-jpl/ION-DTN/security/advisories/GHSA-xm96-38vj-h28h"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-789"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-10-08T13:35:17.944515+00:00", "updated": "2025-10-08T13:35:17.944553+00:00", "vendors": ["nasajpl", "nasajpl$PRODUCT$iondtn"]}