CVE-2026-21900 Details
Description
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, an out-of-bounds heap read vulnerability in cryptography_encrypt() occurs when parsing JSON metadata from KMC server responses. The flawed strtok iteration pattern uses ptr + strlen(ptr) + 1 which reads one byte past allocated buffer boundaries when processing short or malformed metadata strings. This issue has been patched in version 1.4.3.
A heap-based out-of-bounds read vulnerability has been identified in CryptoLib versions prior to 1.4.3. The issue arises in the 'cryptography_encrypt()' function, which secures communications between spacecraft and ground stations using the CCSDS Space Data Link Security Protocol. The vulnerability occurs when the function parses JSON metadata from KMC server responses. The improper use of 'strtok' to iterate over the metadata can lead to reading one byte beyond the allocated buffer, especially with short or malformed strings. This flaw can be exploited by a malicious KMC server or a man-in-the-middle attacker, causing a denial-of-service by crashing the application.
Users can upgrade to CryptoLib version 1.4.3 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nasa/CryptoLib/security/advisories/GHSA-4g6v-36fv-qcvw | CISA-ADP | ExploitVendor Advisory |
| https://github.com/nasa/CryptoLib/commit/2372efd3da1ccb226b4297222e25f41ecc84821d | [email protected] | Patch |
| https://github.com/nasa/CryptoLib/releases/tag/v1.4.3 | [email protected] | Release Notes |
| https://github.com/nasa/CryptoLib/security/advisories/GHSA-4g6v-36fv-qcvw | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nasa cryptolib | < 1.4.3 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 16, 2026 | Initial Analysis | [email protected] |
| Jan 13, 2026 | CVE Modified | CISA-ADP |
| Jan 10, 2026 | New CVE Received | [email protected] |