CVE-2026-67973 Details

A denial-of-service vulnerability has been identified in NASA's Core Flight System (cFS) version 7.0.1. The issue arises in the CFDP (Consultative Committee for Space Data Systems File Delivery Protocol) receive path, where completed transactions are not properly removed from the transaction lookup structure. Instead, they are only transitioned to a hold state. This flaw allows an attacker to replay final CFDP Protocol Data Units (PDUs) of the same transaction, causing resource exhaustion by keeping the transaction active and delaying its normal timeout. The vulnerability can be exploited by injecting or replaying CFDP PDUs, particularly final ones, to manipulate the transaction state and consume system resources.

No specific remediation is provided, but the issue could be addressed by removing completed transactions from the lookup structure or by implementing stricter replay handling for final PDUs.