CVE-2026-54086

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-54086

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54086.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-54086

Aliases

GHSA-6g75-jwgj-hj8v

Published

2026-10-13T18:28:25Z

Modified

2026-10-15T07:07:23Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator

Summary

SLE API for Java: Uncontrolled Memory Allocation / handled exception leading to Denial of Service

Details

SLE API for Java is an implementation of CCSDS Space Link Extension Services. Prior to 5.1.7, the ISP1 PDU handling path decodes an attacker-controlled body length and allocates a byte array without an upper bound, while malformed or truncated input can also terminate reads unexpectedly, allowing an unauthenticated client of the SLE listening service to trigger exceptions, resource leakage, and denial of service. This issue is fixed in version 5.1.7.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-770"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54086.json"
}

References

Affected packages

Git / github.com/esa/sleapi-j

Affected ranges

Type

GIT

Repo

https://github.com/esa/sleapi-j

Events

Introduced

Fixed

265118dfb70d1d0d991b085dcde4028c60bce4fc

Fixed

77286bbfe7e77fcbf467c4b0730b5a8741edfab3

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "5.1.7"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

5.*

5.1.4

5.1.5

5.1.6

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54086.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "275682422059989815661719697826708304720",
                "326005997557963800791895718372400281154",
                "93004827657592374880362176037513037988",
                "16739862527451449268218003612706832726"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-54086-03704684",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/esa/sleapi-j/commit/265118dfb70d1d0d991b085dcde4028c60bce4fc",
        "target":  {
            "file":  "esa.sle.java.api.core/src/main/java/esa/sle/impl/api/apipx/pxtml/EE_APIPX_CtxMessageFactory.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "107023786165741875145245469515617806979",
                "267444762859596116341744052983848456024",
                "216563538778994702889387620803431889901",
                "31048165409124904396258498557352636237",
                "223776254726934307005815721294165910535",
                "244560040531542012623951535597607832108",
                "333366834005780929311582253138551179617",
                "87414439720325836002207904534154067974",
                "295683383662338869422836311892626342212",
                "48782381896445602145396037877919671927",
                "338095796588245984192608823971770546679",
                "125243874761760148100769862548237306718",
                "106630294948400561105886971935143821599",
                "220161876856636245499295850042815038918",
                "49241114249332793609315685371464052954",
                "94781750924807902927091993507701635784",
                "182567671748580896252987550651662855051"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-54086-9138d97c",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/esa/sleapi-j/commit/265118dfb70d1d0d991b085dcde4028c60bce4fc",
        "target":  {
            "file":  "esa.sle.java.api.core/src/main/java/esa/sle/impl/api/apipx/pxtml/EE_APIPX_PDUMessageFactory.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "153674392883173184573204566414506028398",
            "length":  706
        },
        "id":  "CVE-2026-54086-97693cb2",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/esa/sleapi-j/commit/265118dfb70d1d0d991b085dcde4028c60bce4fc",
        "target":  {
            "file":  "esa.sle.java.api.core/src/main/java/esa/sle/impl/api/apipx/pxtml/EE_APIPX_CtxMessageFactory.java",
            "function":  "createTmlMessage"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "148509788269588306598723844310472891763",
            "length":  424
        },
        "id":  "CVE-2026-54086-e4daf34c",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/esa/sleapi-j/commit/265118dfb70d1d0d991b085dcde4028c60bce4fc",
        "target":  {
            "file":  "esa.sle.java.api.core/src/main/java/esa/sle/impl/api/apipx/pxtml/EE_APIPX_PDUMessageFactory.java",
            "function":  "createTmlMessage"
        }
    }
]

vanir_signatures_modified

"2026-10-15T07:07:23Z"