How severe is CVE-2026-22024?

CVE-2026-22024 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.

Is CVE-2026-22024 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (38th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-22024?

CVE-2026-22024 affects Nasa Cryptolib. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-22024?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-22024 have an EU (EUVD) identifier?

Yes. CVE-2026-22024 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-1892.

When was CVE-2026-22024 published?

CVE-2026-22024 was published on 2026-01-10 and last updated on 2026-06-17.

CVE-2026-22024

CVE-2026-22024 is a medium-severity vulnerability in Nasa Cryptolib with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-401.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
CVSS v4: 6.3
EPSS exploit prediction: 0% (38th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-1892
Weakness: CWE-401
Affected product: Nasa Cryptolib
Published: 2026-01-10
Last modified: 2026-06-17

Description

CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, the cryptography_encrypt() function allocates multiple buffers for HTTP requests and JSON parsing that are never freed on any code path. Each call leaks approximately 400 bytes of memory. Sustained traffic can gradually exhaust available memory. This issue has been patched in version 1.4.3.

Frequently asked questions

What is CVE-2026-22024?: CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, the cryptography_encrypt() function allocates multiple buffers for HTTP requests and JSON parsing that are never freed on any code path. Each call leaks approximately 400 bytes of memory. Sustained traffic can gradually exhaust available memory. This issue has been patched in version 1.4.3.
How severe is CVE-2026-22024?: CVE-2026-22024 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.
Is CVE-2026-22024 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (38th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-22024?: CVE-2026-22024 affects Nasa Cryptolib. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-22024?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-22024 have an EU (EUVD) identifier?: Yes. CVE-2026-22024 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-1892.
When was CVE-2026-22024 published?: CVE-2026-22024 was published on 2026-01-10 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:nasa:cryptolib:*:*:*:*:*:*:*:*

More vulnerabilities in Nasa Cryptolib

CVE-2025-30356 — Critical (CVSS 9.8): CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures…
CVE-2025-29913 — Critical (CVSS 9.8): CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures…
CVE-2025-29912 — Critical (CVSS 9.8): CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures…
CVE-2025-29911 — Critical (CVSS 9.8): CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures…
CVE-2025-29909 — Critical (CVSS 9.8): CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures…
CVE-2025-30216 — Critical (CVSS 9.4): CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures…

All CVEs affecting Nasa Cryptolib →

Other CWE-401 (Missing Release of Memory after Effective Lifetime) vulnerabilities

CVE-2026-46289 — Critical (CVSS 9.8): In the Linux kernel, the following vulnerability has been resolved: lib/scatterlist: fix length calculations in…
CVE-2025-39948 — Critical (CVSS 9.8): In the Linux kernel, the following vulnerability has been resolved: ice: fix Rx page leak on multi-buffer frames The…
CVE-2025-21954 — Critical (CVSS 9.8): In the Linux kernel, the following vulnerability has been resolved: netmem: prevent TX of unreadable skbs Currently…
CVE-2024-57947 — Critical (CVSS 9.8): In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_set_pipapo: fix initial map…
CVE-2024-56779 — Critical (CVSS 9.8): In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfs4_openowner leak when concurrent…
CVE-2024-36911 — Critical (CVSS 9.8): In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Don't free decrypted memory In CoCo…

Browse all CWE-401 (Missing Release of Memory after Effective Lifetime) vulnerabilities →