CVE-2026-22023

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, there is an out-of-bounds heap read vulnerability in cryptography_aead_encrypt(). This issue has been patched in version 1.4.3.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
nasa	CryptoLib	< 1.4.3

References

https://github.com/nasa/CryptoLib/commit/2372efd3da1ccb226b4297222e25f41ecc84821dPatch
https://github.com/nasa/CryptoLib/releases/tag/v1.4.3Release Notes
https://github.com/nasa/CryptoLib/security/advisories/GHSA-8w3h-q8jm-3chqExploit, Vendor Advisory
https://github.com/nasa/CryptoLib/security/advisories/GHSA-8w3h-q8jm-3chqExploit, Vendor Advisory

Timeline

Published: Jan 10, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-220245.3CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure comm CVE-2026-220253.7CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure comm CVE-2026-220267.5CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure comm CVE-2026-220276.0CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure comm CVE-2026-220286.1Preact, a lightweight web development framework, JSON serialization protection to prevent Virtual DOM elements from being constructed from a CVE-2026-220296.1React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Re CVE-2026-22038.8A flaw has been found in Tenda AC8 16.03.33.05. Affected by this vulnerability is an unknown functionality of the file /goform/fast_setting_CVE-2026-220306.5React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, React Route CVE-2026-220318.8@fastify/middie is the plugin that adds middleware support on steroids to Fastify. A security vulnerability exists in @fastify/middie prior CVE-2026-220326.1Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.14.0, an open redirect vulnerability ex CVE-2026-220335.4Label Studio is a multi-type data labeling and annotation tool. In 1.22.0 and earlier, a persistent stored cross-site scripting (XSS) vulner CVE-2026-220349.8Snuffleupagus is a module that raises the cost of attacks against website by killing bug classes and providing a virtual patching system. On