CVE-2026-67973

Received Received - Intake

CFDP Replay Attack Causes DoS in NASA cFS

Publication date: 2026-08-03

Last updated on: 2026-08-05

Assigner: MITRE

Description

An issue in the CFDP receive path of NASA cFS v7.0.1 allows attackers to cause a Denial of Service (DoS) via replaying final CFDP PDUs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-03

Last Modified

2026-08-05

Generated

2026-08-24

AI Q&A

2026-08-04

EPSS Evaluated

2026-08-22

NVD

CVE-2026-67973

EUVD

EUVD-2026-52510

Affected Vendors & Products

Vendor	Product	Version / Range
nasa	cfs	7.0.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability is in the CFDP receive path of NASA cFS v7.0.1. Attackers can cause a Denial of Service by replaying final CFDP PDUs, disrupting normal operations.

Impact Analysis

It may lead to system crashes or unresponsiveness, causing downtime for services relying on NASA cFS v7.0.1. This disrupts mission-critical operations dependent on the software.

Compliance Impact

The vulnerability causes a Denial of Service via replaying final CFDP PDUs, which could disrupt system availability. This may impact compliance with standards requiring data availability and integrity, such as GDPR's availability principle or HIPAA's access controls, if systems fail to meet operational requirements.

Mitigation Strategies

Update NASA cFS to a patched version that addresses the CFDP receive path vulnerability. Monitor network traffic for unusual CFDP PDU replay attempts and implement network-level protections to filter malformed packets.

Hi! I’m here to help you understand CVE-2026-67973. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70