CVE-2026-22025: CryptoLib Memory Leak on HTTP Error Response in KMC Client
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, when the KMC server returns a non-200 HTTP status code, cryptographyencrypt() and cryptographydecrypt() return immediately without freeing previously allocated buffers. Each failed request leaks approximately 467 bytes. Repeated failures (from a malicious server or network issues) can gradually exhaust memory. This issue has been patched in version 1.4.3.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22025?
CVE-2026-22025 is classified as a high severity vulnerability due to potential impacts on the integrity and confidentiality of communications.
How do I fix CVE-2026-22025?
To resolve CVE-2026-22025, upgrade CryptoLib to version 1.4.3 or a later version.
What versions of CryptoLib are affected by CVE-2026-22025?
CryptoLib versions prior to 1.4.3 are affected by CVE-2026-22025.
What type of vulnerability is CVE-2026-22025?
CVE-2026-22025 is a cryptographic vulnerability that affects the security protocol used for communication.
Who is the vendor for CVE-2026-22025?
The vendor for CVE-2026-22025 is CryptoLib.