CVE-2026-22025

CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, when the KMC server returns a non-200 HTTP status code, cryptography_encrypt() and cryptography_decrypt() return immediately without freeing previously allocated buffers. Each failed request leaks approximately 467 bytes. Repeated failures (from a malicious server or network issues) can gradually exhaust memory. This issue has been patched in version 1.4.3.

• CWE-401
• CWE-770

• https://github.com/nasa/CryptoLib/commit/2372efd3da1ccb226b4297222e25f41ecc84821dPatch
• https://github.com/nasa/CryptoLib/releases/tag/v1.4.3Release Notes
• https://github.com/nasa/CryptoLib/security/advisories/GHSA-h74x-vwwr-mm5gExploit, Vendor Advisory
• https://github.com/nasa/CryptoLib/security/advisories/GHSA-h74x-vwwr-mm5gExploit, Vendor Advisory

Published

Jan 10, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-22019Vulnerability in the PeopleSoft Enterprise HCM Shared Compon…5.4
• CVE-2026-2202A vulnerability was detected in Tenda AC8 16.03.33.05. Affec…8.8
• CVE-2026-22021Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK,…5.3
• CVE-2026-22022Deployments of Apache Solr 5.3.0 through 9.10.0 that rely on…8.2
• CVE-2026-22023CryptoLib provides a software-only solution using the CCSDS …7.5
• CVE-2026-22024CryptoLib provides a software-only solution using the CCSDS …5.3
• CVE-2026-22026CryptoLib provides a software-only solution using the CCSDS …7.5
• CVE-2026-22027CryptoLib provides a software-only solution using the CCSDS …6
• CVE-2026-22028Preact, a lightweight web development framework, JSON serial…6.1
• CVE-2026-22029React Router is a router for React. In @remix-run/router ver…6.1
• CVE-2026-2203A flaw has been found in Tenda AC8 16.03.33.05. Affected by …8.8
• CVE-2026-22030React Router is a router for React. In @remix-run/server-run…6.5