PT-2026-2134 · Cryptolib+1 · Cryptolib+1

Enitmar + 1 · Published 2026-01-10 · Updated 2026-01-10 · CVE-2026-22026

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions CryptoLib versions prior to 1.4.3

Description CryptoLib is a software solution utilizing the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) for secure communication between a spacecraft and a ground station. The write callback function within the KMC crypto service client, prior to version 1.4.3, does not adequately limit the size of reallocated response buffers. This allows a malicious KMC server to send arbitrarily large HTTP responses, leading to excessive memory allocation and potential process termination. The vulnerable component is the libcurl function used for handling HTTP responses. The write callback function is specifically affected.

Recommendations Versions prior to 1.4.3 should be updated to version 1.4.3 or later.

Exploit

Fix

Weakness Enumeration

CWE-789

Related Identifiers

CVE-2026-22026

GHSA-W9CM-Q69W-34X7

Affected Products

Cryptolib

Libcurl

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22026.json · Exploit
• 🔥 https://github.com/nasa/CryptoLib/security/advisories/GHSA-w9cm-q69w-34x7 · Exploit
• https://github.com/nasa/CryptoLib/commit/2372efd3da1ccb226b4297222e25f41ecc84821d · Patch
• https://osv.dev/vulnerability/CVE-2026-22026 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22026 · Security Note
• https://github.com/nasa/CryptoLib/releases/tag/v1.4.3 · Note
• https://t.me/CVEtracker/41893 · Telegram Post
• https://twitter.com/CVEnew/status/2009846300058235307 · Twitter Post