Executive brief
ION-DTN is a delay-tolerant networking implementation used in space communications and remote network applications. An unauthenticated remote attacker can crash the ION process by sending a specially crafted network message with an empty payload, causing an unhandled assertion failure that terminates the entire service and disrupts communications.
Technical details
The vulnerability is a reachable assertion in the canonicalizePayloadBlock() function in bpsec_util.c. The function passes bundle->payload.length directly to zco_clone() without validating that the length is non-zero; zco_clone() enforces CHKZERO(length > 0) as a hard precondition via a macro that triggers sm_Abort() and abort() on failure. An attacker sends a BPv7 bundle with a zero-length payload (a legal construct in BPv7 specification: the empty CBOR byte string h''). The abort occurs before any HMAC cryptographic verification, requiring no valid credentials or keys. The attack requires a BPSec policy rule on the target node that covers the payload block, narrowing the attack surface compared to a similar prior vulnerability (GHSA-27wg-h3xq-4p9g). The defect class and fix approach were already addressed once in acquireBundle() but this second call site was missed.
Affected products
- NASA JPL ION-DTN <= 4.2.0
Timeline
- 2026-09-10: disclosed
- 2026-09-10: patched: Fixed in version 4.2.1-a.1