CVE-2024-54130: Segmentation Fault in `forwardBundle` Function of ION-DTN BPv7 When Destination EID is `dtn:none` (public)

Severity: critical (CVSS 9.2 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-12-05 · updated 2026-06-17
Weakness: CWE-476

Description

The NASA’s Interplanetary Overlay Network (ION) is an implementation of Delay/Disruption Tolerant Networking (DTN). A segmentation fault occurs with ION-DTN BPv7 software version 4.1.3 when a bundle with a Destination Endpoint ID (EID) set to dtn:none is received. This causes the node to become unresponsive to incoming bundles, leading to a Denial of Service (DoS) condition. This vulnerability is fixed in 4.1.3s.

Affected products

Nasajpl Iondtn: before 4.1.3s — fixed in 4.1.3s

How to fix

Upgrade to a fixed version: Nasajpl Iondtn 4.1.3s. Check the vendor advisory for mitigations.

References

https://github.com/nasa-jpl/ION-DTN/security/advisories/GHSA-7pj7-hfwv-q3v6

Get alerted when CVE-2024-54130 or the next vulnerability affects your stack