CVE-2025-61910
NASA ION-DTN BPv7 4.1.3s Uncontrolled Memory Allocation that leads to Denial-of-Service
Description
The NASA’s Interplanetary Overlay Network (ION) is an implementation of Delay/Disruption Tolerant Networking (DTN). A BPv7 bundle with a malformed extension block causes uncontrolled memory allocation inside ION-DTN 4.1.3s, leading to receiver thread termination and a Denial-of-Service (DoS). The triggering bundle contains an extension block starting at `0x85070201005bbb0e20b4ea001a000927c0...`. The first byte in the extension block (0x85) indicates a CBOR array of five elements of which the first four are numbers (0x07, 0x02, 0x01, 0x00) but the fifth element is a byte string of length 27 (`0x5bbb0e20b4ea001a000927c0...`). The vulnerability seems to be due to processing the fifth element of the array (i.e., the byte string) as replacing it with a number makes the vulnerability no longer be triggered. While parsing this extension block, ION obtains a very large block length, which in the code in `bei.c`:764) seems to be passed from `blockLength` which is an unsigned int, to a 32 bit signed integer `blkSize`. The unsigned to signed conversion causes `blkSize` to hold the value of -369092043, which is then converted into a 64-bit unsigned value inside `MTAKE(blkSize)`, resulting in an attempt to allocate an unrealistic amount of memory, causing the error. As of time of publication, no known patched versions of BPv7 exist.
INFO
Published Date :
Oct. 7, 2025, 8:15 p.m.
Last Modified :
Oct. 8, 2026, 1:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
Affected Products
The following products are affected by CVE-2025-61910
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | [email protected] |
Solution
- Implement strict validation of incoming bundle extension blocks.
- Monitor network traffic for malformed bundles.
- Consider network segmentation to limit impact.
- Apply vendor patches when they become available.
Public PoC/Exploit Available at Github
CVE-2025-61910 has a 1 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-61910.
| URL | Resource |
|---|---|
| https://github.com/nasa-jpl/ION-DTN/blob/ion-open-source-4.1.3s/bpv7/library/bei.c#L758-L769 | |
| https://github.com/nasa-jpl/ION-DTN/security/advisories/GHSA-xm96-38vj-h28h |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-61910 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-61910
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
None
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-61910 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2025-61910 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 08, 2026
Action Type Old Value New Value Added Translation Title: ION-DTN de nasa-jpl, Description: La Red de Superposición Interplanetaria (ION) de la NASA es una implementación de Redes Tolerantes a Retrasos/Interrupciones (DTN). Un paquete BPv7 con un bloque de extensión malformado causa una asignación de memoria incontrolada dentro de ION-DTN 4.1.3s, lo que lleva a la terminación del hilo del receptor y a una Denegación de Servicio (DoS). El paquete desencadenante contiene un bloque de extensión que comienza en '0x85070201005bbb0e20b4ea001a000927c0...'. El primer byte en el bloque de extensión (0x85) indica un array CBOR de cinco elementos de los cuales los primeros cuatro son números (0x07, 0x02, 0x01, 0x00) pero el quinto elemento es una cadena de bytes de longitud 27 ('0x5bbb0e20b4ea001a000927c0...'). La vulnerabilidad parece deberse al procesamiento del quinto elemento del array (es decir, la cadena de bytes) ya que reemplazarlo con un número hace que la vulnerabilidad ya no se active. Al analizar este bloque de extensión, ION obtiene una longitud de bloque muy grande, que en el código en 'bei.c':764) parece ser pasado de 'blockLength' que es un entero sin signo, a un entero con signo de 32 bits 'blkSize'. La conversión de sin signo a con signo hace que 'blkSize' contenga el valor de -369092043, que luego se convierte en un valor sin signo de 64 bits dentro de 'MTAKE(blkSize)', lo que resulta en un intento de asignar una cantidad irreal de memoria, causando el error. A la fecha de publicación, no existen versiones parcheadas conocidas de BPv7. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'nasa-jpl', 'product': 'ION-DTN', 'versions': [{'status': 'affected', 'version': '= 4.1.3s'}]}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2025-61910', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'yes'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2025-10-07T19:56:09.913548Z'} -
New CVE Received by [email protected]
Oct. 07, 2025
Action Type Old Value New Value Added Description The NASA’s Interplanetary Overlay Network (ION) is an implementation of Delay/Disruption Tolerant Networking (DTN). A BPv7 bundle with a malformed extension block causes uncontrolled memory allocation inside ION-DTN 4.1.3s, leading to receiver thread termination and a Denial-of-Service (DoS). The triggering bundle contains an extension block starting at `0x85070201005bbb0e20b4ea001a000927c0...`. The first byte in the extension block (0x85) indicates a CBOR array of five elements of which the first four are numbers (0x07, 0x02, 0x01, 0x00) but the fifth element is a byte string of length 27 (`0x5bbb0e20b4ea001a000927c0...`). The vulnerability seems to be due to processing the fifth element of the array (i.e., the byte string) as replacing it with a number makes the vulnerability no longer be triggered. While parsing this extension block, ION obtains a very large block length, which in the code in `bei.c`:764) seems to be passed from `blockLength` which is an unsigned int, to a 32 bit signed integer `blkSize`. The unsigned to signed conversion causes `blkSize` to hold the value of -369092043, which is then converted into a 64-bit unsigned value inside `MTAKE(blkSize)`, resulting in an attempt to allocate an unrealistic amount of memory, causing the error. As of time of publication, no known patched versions of BPv7 exist. Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Added CWE CWE-789 Added Reference https://github.com/nasa-jpl/ION-DTN/blob/ion-open-source-4.1.3s/bpv7/library/bei.c#L758-L769 Added Reference https://github.com/nasa-jpl/ION-DTN/security/advisories/GHSA-xm96-38vj-h28h