CVE-2026-121508
Awaiting Analysis Awaiting Analysis - Queue

Use-After-Free in µD3TN BPv6 Fragmenter Cleanup

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: GitLab Inc.

Description
Use-After-Free in µD3TN BPv6 Fragmenter Cleanup allows Unauthenticated Remote Attacker to Cause DoS on Allocation Failure

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-121508
EUVD
EUVD-2026-115829

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
D3TN GmbH µD3TN 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-121508 is a Use-After-Free vulnerability in the µD3TN BPv6 fragmenter cleanup process. When fragmentation fails to duplicate a block, cleanup code incorrectly writes the block-list head through an advanced cursor, creating a cycle in the payload list. This causes bundle_free to traverse the cycle, freeing the same node twice, leading to a use-after-free and double-free in fragment.c. The corruption results in a segmentation fault, terminating the µD3TN process and halting all bundle forwarding.

Detection Guidance

Detecting this vulnerability requires monitoring for crashes or segmentation faults in the µD3TN process. Check logs for 'segmentation fault' errors in µD3TN logs or system logs. Monitor for unexpected termination of the µD3TN daemon. Use tools like gdb to analyze core dumps if crashes occur.

Impact Analysis

An unauthenticated remote attacker can exploit this vulnerability to cause a denial-of-service (DoS) by triggering an allocation failure during fragmentation. This leads to a crash of the µD3TN process, stopping all bundle forwarding and disrupting network communication relying on this software.

Mitigation Strategies

Apply the official patch from µD3TN if available. Disable fragmentation if not required. Monitor for bundles with payload blocks followed by MUST_BE_REPLICATED blocks. Restrict network access to µD3TN instances to trusted sources only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121508. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...