CVE-2026-75584

ION-DTN before 4.2.1-a.1, an open-source implementation of the Delay/Disruption-Tolerant Networking (DTN) Bundle Protocol, contains a remotely triggerable denial-of-service flaw in its BPSec payload handling. An unauthenticated remote attacker can crash the ION process by sending a BPv7 bundle whose payload block has a zero-length payload: canonicalizePayloadBlock() in bpsec_util.c passes the unvalidated zero length to zco_clone(), tripping a CHKZERO assertion that invokes sm_Abort() and terminates the process with SIGABRT before any HMAC verification occurs, so no valid key or credential is required. The impact is availability only — the affected ION process dies, disrupting bundle forwarding and DTN communications on that node until it is restarted; the CVSS 4.0 vector (VA:H, VC:N/VI:N) confirms no confidentiality or integrity impact. Any deployment running ION-DTN prior to 4.2.1-a.1 that accepts bundles from remote peers, particularly with BPSec processing enabled, is affected. No public proof-of-concept is known and the issue is not in CISA's KEV, so no in-the-wild exploitation is documented, but the trivial trigger conditions (no authentication, no key) make it easy to weaponize.

What to do: Upgrade ION-DTN to 4.2.1-a.1 or later, which adds validation of the payload length before it reaches zco_clone(). Until patched, restrict which remote peers can deliver BPv7 bundles to ION endpoints (e.g., firewall or ACL the Bundle Protocol ingress) and monitor ION processes for SIGABRT terminations or unexpected restarts, since the crash requires no authentication or BPSec key. Verify your currently installed ION version against the fixed release during remediation.