Executive brief
µD3TN is a delay-tolerant network daemon that implements the Bundle Protocol for intermittent network communications. An integer overflow in the TCPCLv3 connection handshake allows unauthenticated remote attackers to cause a denial of service by crashing the process, potentially disrupting network relay operations and bundle message delivery.
Technical details
An integer overflow vulnerability exists in µD3TN's TCPCLv3 handshake implementation where the peer EID (Endpoint Identifier) length field, stored as uint32_t, is incremented by 1 and used as the size argument to malloc(). When a remote client sends UINT32_MAX as the EID length, the expression "peer_eid_len + 1" wraps to zero, causing malloc(0) to be called. The daemon then attempts to write the original full-length data into the zero-sized allocation via recv(), triggering a heap buffer overflow. This occurs during the initial unauthenticated handshake, allowing any network-reachable attacker to reliably crash the process. The vulnerability has existed since at least the 0.8.0 import in 2020.
Affected products
- D3TN µD3TN v0.15.0 and earlier
Timeline
- 2026-09-18: disclosed