ION‑DTN before 4.2.1‑a.1 contains a flaw that allows an unauthenticated remote attacker to crash the ION process. The canonicalizePayloadBlock() function forwards a bundle’s zero‑length payload size to zco_clone() without checking that it is non‑zero, causing a failed CHKZERO assertion that triggers sm_Abort() and terminates the process with SIGABRT. The crash occurs before any HMAC verification, so no valid key or credential is required to exploit the vulnerability. This defect only disrupts availability; confidentiality and integrity are unaffected.

The vulnerability affects NASA JPL’s ION‑DTN distributed networking software. All releases older than 4.2.1‑a.1 are susceptible; the exact impacted versions are all those prior to the 4.2.1‑a.1 release. The affected product is commonly deployed in DTN deployments that rely on ION for space or remote connectivity.

The CVSS score of 8.7 indicates a high severity. The EPSS score is not available, so the probability of exploitation cannot be quantified, but the lack of authentication requirements and the simplicity of sending a crafted zero‑length BPv7 bundle suggest a straightforward exploitation path. The flaw is not listed in CISA KEV. Attackers can target any reachable ION node by sending a malformed BPv7 bundle over the public interface used for normal traffic. The risk to environments exposed to external networks is significant, as a single crafted bundle can terminate the ION service.