Quick answers
- Is CVE-2026-121512 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-121512 being exploited in the wild.
- How severe is CVE-2026-121512?
- High severity, with a CVSS score of 7.5, published 3 November 2026.
- Which products and versions are affected?
- D3TN µD3TN.
- Is there a fix for CVE-2026-121512?
- No fixed version is recorded yet. Restrict network access to the µD3TN convergence layer (mtcp, smtcp, TCPCLv3) to trusted peers only until a patch is available; implement bundle size limits accounting for resolved EID reference memory consumption.</anigation> </invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-121512 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-121512?
- Check whether you run D3TN µD3TN. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Restrict network access to the µD3TN convergence layer (mtcp, smtcp, TCPCLv3) to trusted peers only until a patch is available; implement bundle size limits accounting for resolved EID reference memory consumption.</anigation> </invoke>
Technical details
The vulnerability is a memory leak with amplification in the BPv6 bundle block freeing logic. The `bundle_block_free()` function in bundle.c treats a singly linked list of EID references as a single allocation and calls free() only once, leaking all list nodes and resolved EID strings. The BPv6 parser allocates one node per reference with unbounded count, and each reference resolves to a separate heap copy of up to 32 KiB. An unauthenticated peer can send a small bundle (tens of kilobytes) that leaks hundreds of megabytes, exhausting memory at a rate of 1,000–16,000 bytes per byte sent; memory is never reclaimed even when the bundle is deleted or the connection closes.
Affected products
- D3TN µD3TN
Timeline
- 2026-11-03: disclosed