CVE-2026-79954

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-79954

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-79954.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-79954

Published

2026-09-18T00:26:28Z

Modified

2026-09-19T11:30:23Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

NASA CryptoLib 1.5.0 - TC receive path accepts Security Associations from the wrong GVCID

Details

NASA CryptoLib 1.5.0 contains an authentication downgrade vulnerability in the Telecommand (TC) receive path. The receiver selects the Security Association used for SDLS processing solely from the SPI field inside the incoming frame, but it does not verify that the selected SA is authorized for the frame's GVCID.

Database specific

{
    "cna_assigner": "Fluid Attacks",
    "cwe_ids": [
        "CWE-306"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/79xxx/CVE-2026-79954.json"
}

References

Affected packages

Git / github.com/nasa/cryptolib

Affected ranges

Type

GIT

Repo

https://github.com/nasa/cryptolib

Events

Introduced

c9109bd190180e297a1fe1d1906976e1fdcd3caf

Last Affected

c9109bd190180e297a1fe1d1906976e1fdcd3caf

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "1.5.0"
        },
        {
            "last_affected": "1.5.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*

1.5.0

v.*

v.1.5.0

v1.*

v1.5.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-79954.json"