# CVE-2026-75584: ION-DTN denial of service via canonicalizePayloadBlock assertion

Source: https://junglewise.ai/threats/cve-2026-75584-ion-dtn-denial-of-service-via-canonicalizepayloadblock-assertion  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-10. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-75584 · Severity: high · CVSS 7.5 · Published 2026-09-10

ION-DTN is a delay-tolerant networking implementation used in space communications and remote network applications. An unauthenticated remote attacker can crash the ION process by sending a specially crafted network message with an empty payload, causing an unhandled assertion failure that terminates the entire service and disrupts communications.

## Quick answers

**Is CVE-2026-75584 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75584 being exploited in the wild.

**How severe is CVE-2026-75584?** High severity, with a CVSS score of 7.5, published 10 September 2026.

**Which products and versions are affected?** NASA JPL ION-DTN <= 4.2.0.

**Is there a fix for CVE-2026-75584?** A patch was published on 2026-09-10: Fixed in version 4.2.1-a.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-75584 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-75584?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a reachable assertion in the canonicalizePayloadBlock() function in bpsec_util.c. The function passes bundle->payload.length directly to zco_clone() without validating that the length is non-zero; zco_clone() enforces CHKZERO(length > 0) as a hard precondition via a macro that triggers sm_Abort() and abort() on failure. An attacker sends a BPv7 bundle with a zero-length payload (a legal construct in BPv7 specification: the empty CBOR byte string h''). The abort occurs before any HMAC cryptographic verification, requiring no valid credentials or keys. The attack requires a BPSec policy rule on the target node that covers the payload block, narrowing the attack surface compared to a similar prior vulnerability (GHSA-27wg-h3xq-4p9g). The defect class and fix approach were already addressed once in acquireBundle() but this second call site was missed.

## Affected products

- NASA JPL ION-DTN <= 4.2.0

## Timeline

- 2026-09-10: disclosed
- 2026-09-10: patched: Fixed in version 4.2.1-a.1

## References

- [https://github.com/nasa-jpl/ION-DTN/security/advisories/GHSA-9vgc-2r6g-6qwf](https://github.com/nasa-jpl/ION-DTN/security/advisories/GHSA-9vgc-2r6g-6qwf)
- [https://www.vulncheck.com/advisories/ion-dtn-a-1-denial-of-service-via-canonicalizepayloadblock-assertion](https://www.vulncheck.com/advisories/ion-dtn-a-1-denial-of-service-via-canonicalizepayloadblock-assertion)