PT-2026-2133 · Cryptolib · Cryptolib

Enitmar + 1 · Published 2026-01-10 · Updated 2026-01-10 · CVE-2026-22025

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions CryptoLib versions prior to 1.4.3

Description CryptoLib is a software solution utilizing the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft and a ground station. Before version 1.4.3, the cryptography encrypt() and cryptography decrypt() functions do not free allocated buffers when the KMC server returns a non-200 HTTP status code. Each failed request results in a memory leak of approximately 467 bytes, potentially leading to memory exhaustion with repeated failures. The issue occurs when interacting with the KMC server.

Recommendations Update to CryptoLib version 1.4.3 or later.

Exploit

Fix

Memory Leak

Allocation of Resources Without Limits

Weakness Enumeration

CWE-401

CWE-770

Related Identifiers

CVE-2026-22025

GHSA-H74X-VWWR-MM5G

Affected Products

Cryptolib

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22025.json · Exploit
• 🔥 https://github.com/nasa/CryptoLib/security/advisories/GHSA-h74x-vwwr-mm5g · Exploit
• https://github.com/nasa/CryptoLib/commit/2372efd3da1ccb226b4297222e25f41ecc84821d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-22025 · Security Note
• https://osv.dev/vulnerability/CVE-2026-22025 · Vendor Advisory
• https://github.com/nasa/CryptoLib/releases/tag/v1.4.3 · Note
• https://twitter.com/VulmonFeeds/status/2009812963234898056 · Twitter Post
• https://twitter.com/CVEnew/status/2009846301115199707 · Twitter Post
• https://t.me/CVEtracker/41892 · Telegram Post