CVE-2025-29910

CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. A memory leak vulnerability was identified in the `crypto_handle_incrementing_nontransmitted_counter` function of CryptoLib versions 1.3.3 and prior. This vulnerability can lead to resource exhaustion and degraded system performance over time, particularly in long-running processes or systems processing large volumes of data. The vulnerability is present in the `crypto_handle_incrementing_nontransmitted_counter` function within `crypto_tc.c`. The function allocates memory using `malloc` without ensuring the allocated memory is always freed. This issue can lead to resource exhaustion, reduced system performance, and potentially a Denial of Service (DoS) in environments where CryptoLib is used in long-running processes or with large volumes of data. Any system using CryptoLib, especially those handling high-throughput or continuous data streams, could be impacted. As of time of publication, no known patched versions are available.

• CWE-401

• https://github.com/nasa/CryptoLib/security/advisories/GHSA-p38w-p2r8-g6g5Exploit, Vendor Advisory
• https://github.com/nasa/CryptoLib/security/advisories/GHSA-p38w-p2r8-g6g5Exploit, Vendor Advisory

Published

Mar 17, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-29905A vulnerability has been identified in TeleControl Server Ba…8.8
• CVE-2025-29906Finit is a fast init for Linux systems. Versions starting fr…8.6
• CVE-2025-29907jsPDF is a library to generate PDFs in JavaScript. Prior to …7.5
• CVE-2025-29908Netty QUIC codec is a QUIC codec for netty which makes use o…5.3
• CVE-2025-29909CryptoLib provides a software-only solution using the CCSDS …9.8
• CVE-2025-2991A vulnerability classified as critical has been found in Ten…6.9
• CVE-2025-29911CryptoLib provides a software-only solution using the CCSDS …9.8
• CVE-2025-29912CryptoLib provides a software-only solution using the CCSDS …9.8
• CVE-2025-29913CryptoLib provides a software-only solution using the CCSDS …9.8
• CVE-2025-29914OWASP Coraza WAF is a golang modsecurity compatible web appl…5.4
• CVE-2025-29915Suricata is a network Intrusion Detection System, Intrusion …7.5
• CVE-2025-29916Suricata is a network Intrusion Detection System, Intrusion …5.5