The vulnerability is a memory leak in CryptoLib’s cryptography_encrypt() function. Each invocation allocates several buffers for HTTP requests and JSON parsing that are never released, resulting in a leak of roughly 400 bytes per call. Accumulated over sustained traffic, this leak can deplete available memory and bring the system to a state of denial of service. The weakness is a classic memory leak issue, classified as CWE-401, which undermines the integrity of the process’s resource allocation.

The affected product is NASA’s CryptoLib, a software-only implementation of the CCSDS Space Data Link Security Protocol – Extended Procedures used for securing communications between a spacecraft’s core Flight System and a ground station. Versions of CryptoLib prior to 1.4.3 contain the flaw; the issue was corrected in the 1.4.3 release.

With a CVSS score of 6.3, the vulnerability carries medium severity, and the EPSS score of less than 1 % indicates a low probability of exploit at the time of assessment. The flaw is not listed in the CISA KEV catalog. Exploitation would typically occur through a flood of HTTP requests that trigger the encrypt function, causing maille to accumulate. Attackers with network access to the system or those who can generate such traffic could potentially bring a system to resource exhaustion.