CryptoLib implements the CCSDS Space Data Link Security Protocol – Extended Procedures for secure communications between a spacecraft running the core Flight System (cFS) and a ground station. In versions before 1.4.3, if the KMC client receives a non‑200 HTTP response, the cryptography_encrypt() and cryptography_decrypt() functions return immediately without freeing previously allocated buffers, leaking approximately 467 bytes of memory with each failure. Repeated failures can accumulate enough leaked data to exhaust available memory, potentially causing application crashes or degraded performance, and thereby leading to service disruption. The vulnerability maps to CWE‑401 (Memory Leak) and CWE‑770 (Out‑of‑Band Resource Exhaustion).

The affected system is the NASA CryptoLib package. All releases before 1.4.3, including 1.4.2 and earlier versions, are vulnerable. Any deployment that uses CryptoLib for cryptographic functions in KMC client applications is impacted.

The CVSS score of 6.3 indicates moderate severity. The EPSS score of less than 1 % suggests a very low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to trigger multiple failed HTTP interactions with a KMC client, either by controlling a malicious KMC server or by inducing network errors. The impact is limited to increased memory consumption and potential denial of service, with no direct compromise of data confidentiality or integrity.