Network-message length validation failure
Length fields are attacker-controlled until validated. This is a compact reminder to tie protocol limits directly to buffer capacity and test every rejection path.
Editorial decision card. This page links to a source-verified public disclosure and contains only original defensive analysis. It does not mirror upstream HTML, payloads, attachments, private submissions, or exploit steps.
- Original severity
- P2 source-reported; not rescored by vulns.co
- Public source
- bugcrowd crowdstream
- Program / vendor
- National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
- Product / surface
- SBN-Client message ingestion
- Weakness
- Stack-based buffer overflow · CWE-121
- Affected boundary
- Network-provided message handling in client software
- Disclosure date
- 2026-05-05
- Public status checked
- 2026-09-10
- Public attribution
- Excal1bur
What the evidence established
The public report identifies a received length being trusted before copy into a fixed-size buffer and notes a public fix.
Why the impact was credible
The source reported memory-corruption risk from malformed network input.
Durable engineering lesson
Length fields are attacker-controlled until validated. This is a compact reminder to tie protocol limits directly to buffer capacity and test every rejection path.
Control pattern
Check received lengths before allocation or copy, use size-aware APIs, and add boundary-focused regression tests and fuzzing.
Primary public disclosure
Upstream availability and wording can change. Public status was last checked 2026-09-10.