PT-2026-2133 · Cryptolib · Cryptolib

Enitmar + 1 · Publicado 2026-01-10 · Atualizado 2026-01-10 · CVE-2026-22025

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Média

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions CryptoLib versions prior to 1.4.3

Description CryptoLib is a software solution utilizing the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft and a ground station. Before version 1.4.3, the cryptography encrypt() and cryptography decrypt() functions do not free allocated buffers when the KMC server returns a non-200 HTTP status code. Each failed request results in a memory leak of approximately 467 bytes, potentially leading to memory exhaustion with repeated failures. The issue occurs when interacting with the KMC server.

Recommendations Update to CryptoLib version 1.4.3 or later.

Exploit

Correção

Memory Leak

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-401

CWE-770

Identificadores relacionados

CVE-2026-22025

GHSA-H74X-VWWR-MM5G

Produtos afetados

Cryptolib

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22025.json · Exploit
• 🔥 https://github.com/nasa/CryptoLib/security/advisories/GHSA-h74x-vwwr-mm5g · Exploit
• https://github.com/nasa/CryptoLib/releases/tag/v1.4.3 · Nota
• https://github.com/nasa/CryptoLib/commit/2372efd3da1ccb226b4297222e25f41ecc84821d · Correção
• https://twitter.com/VulmonFeeds/status/2009812963234898056 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-22025 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-22025 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2009846301115199707 · Publicação no Twitter
• https://t.me/CVEtracker/41892 · Publicação no Telegram