CVE-2026-21899 Details
Description
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, in base64urlDecode, padding-stripping dereferences input[inputLen - 1] before checking that inputLen > 0 or that input != NULL. For inputLen == 0, this becomes an OOB read at input[-1], potentially crashing the process. If input == NULL and inputLen == 0, it dereferences NULL - 1. This issue has been patched in version 1.4.3.
A moderate severity out-of-bounds read vulnerability has been identified in CryptoLib versions prior to 1.4.3. The issue arises in the Base64url decoding function, where the code improperly handles input length and null values. Specifically, it dereferences the last byte of the input before verifying that the input length is greater than zero or that the input is not null. This flaw can lead to an out-of-bounds read, potentially crashing the process. The vulnerability can be triggered by decoding an empty Base64url string, which is a valid input scenario that the function does not properly accommodate.
Users can upgrade to CryptoLib version 1.4.3, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nasa/CryptoLib/releases/tag/v1.4.3 | [email protected] | Release Notes |
| https://github.com/nasa/CryptoLib/security/advisories/GHSA-wc29-5hw7-mpj8 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nasa cryptolib | < 1.4.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 15, 2026 | Initial Analysis | [email protected] |
| Jan 10, 2026 | New CVE Received | [email protected] |