Bug 2570559 (CVE-2026-124000)

Summary: CVE-2026-124000 ion-dtn: ion-dtn: Denial of service via crafted MAMS messages in amsd
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerability-draftAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in ion-dtn. In the Asynchronous Message Service daemon (amsd), insufficient buffer size allocation can lead to an out-of-bounds write. A remote, unauthenticated peer can exploit this flaw by sending specially crafted Meta-Asynchronous Message Service (MAMS) configuration management messages. Successful exploitation allows an attacker to crash the configuration server thread, causing a denial of service (DoS) and potentially destabilizing shared memory.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-10 20:07:03 UTC 
NASA JPL ION-DTN 2.1.0 through 4.2.0 contains a heap buffer under-allocation vulnerability in the Asynchronous Message Service daemon (amsd) that allows a rogue or misconfigured peer to trigger an out-of-bounds write by sending crafted Meta-AMS (MAMS) configuration management messages that are processed without cryptographic authentication. Attackers can exploit the insufficient buffer size calculation for the internal state-event object to crash the active Configuration Server thread, causing a denial of service and potentially destabilizing subsequent shared-memory allocations in amsd.