Is CVE-2026-124000 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-124000 being exploited in the wild.

How severe is CVE-2026-124000?

Medium severity, with a CVSS score of 5.3, published 9 November 2026.

Which products and versions are affected?

NASA JPL ION-DTN 2.1.0 through 4.2.0.

How is CVE-2026-124000 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-124000?

Check whether you run NASA JPL ION-DTN at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-124000: NASA JPL ION-DTN heap buffer under-allocation in amsd

CVE-2026-124000 · Severity: medium · CVSS 5.3 · Published 2026-11-09

NASA JPL ION-DTN is a delay-tolerant networking software suite used for space communications and remote network operations. A flaw in the Asynchronous Message Service daemon allows a rogue peer on the local network to send crafted configuration messages that crash the Configuration Server, causing a denial of service and potentially corrupting memory allocations within the daemon.

Technologies: NASA JPL ION-DTN. Vendors: NASA JPL.

Quick answers

Is CVE-2026-124000 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-124000 being exploited in the wild.
How severe is CVE-2026-124000?: Medium severity, with a CVSS score of 5.3, published 9 November 2026.
Which products and versions are affected?: NASA JPL ION-DTN 2.1.0 through 4.2.0.
Is there a fix for CVE-2026-124000?: Yes: fixed in 4.2.1-a.2. Until then: Restrict MAMS traffic to trusted internal peers and ensure AMS continua are properly isolated behind local host or perimeter firewalls; do not expose MAMS control-plane traffic to the public internet or across untrusted network boundaries. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-124000 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-124000?: Check whether you run NASA JPL ION-DTN at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.2.1-a.2

Restrict MAMS traffic to trusted internal peers and ensure AMS continua are properly isolated behind local host or perimeter firewalls; do not expose MAMS control-plane traffic to the public internet or across untrusted network boundaries.

Technical details

The vulnerability is a heap buffer under-allocation in the AMS daemon's memory allocation logic for internal state-event objects during configuration message handling. An attacker on the local network with network access can send unauthenticated Meta-AMS (MAMS) configuration messages to trigger an out-of-bounds write, crashing the Configuration Server thread and destabilizing subsequent shared-memory allocations. The vulnerability affects versions 2.1.0 through 4.2.0 and requires no privileges or user interaction.

Affected products

NASA JPL ION-DTN 2.1.0 through 4.2.0

Timeline

2026-11-07: disclosed
2026-11-07: patched: version 4.2.1-a.2 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.