PT-2026-2134 · Cryptolib+1 · Cryptolib+1

Enitmar + 1 · Publicado 2026-01-10 · Atualizado 2026-01-10 · CVE-2026-22026

Positive Technologies (AI Summary)

CVSS v4.0

8.2

Alta

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions CryptoLib versions prior to 1.4.3

Description CryptoLib is a software solution utilizing the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) for secure communication between a spacecraft and a ground station. The write callback function within the KMC crypto service client, prior to version 1.4.3, does not adequately limit the size of reallocated response buffers. This allows a malicious KMC server to send arbitrarily large HTTP responses, leading to excessive memory allocation and potential process termination. The vulnerable component is the libcurl function used for handling HTTP responses. The write callback function is specifically affected.

Recommendations Versions prior to 1.4.3 should be updated to version 1.4.3 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-789

Identificadores relacionados

CVE-2026-22026

GHSA-W9CM-Q69W-34X7

Produtos afetados

Cryptolib

Libcurl

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22026.json · Exploit
• 🔥 https://github.com/nasa/CryptoLib/security/advisories/GHSA-w9cm-q69w-34x7 · Exploit
• https://github.com/nasa/CryptoLib/releases/tag/v1.4.3 · Nota
• https://github.com/nasa/CryptoLib/commit/2372efd3da1ccb226b4297222e25f41ecc84821d · Correção
• https://t.me/CVEtracker/41893 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2009846300058235307 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-22026 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-22026 · Nota de Segurança