CVE-2026-67973 Overview
CVE-2026-67973 is a denial-of-service vulnerability in the CCSDS File Delivery Protocol (CFDP) receive path of NASA's Core Flight System (cFS) version 7.0.1. Attackers can trigger the flaw by replaying final CFDP Protocol Data Units (PDUs) to the receiver, exhausting resources and disrupting file delivery services. The issue is tracked under [CWE-400: Uncontrolled Resource Consumption]. The vulnerability is network-reachable and requires no authentication or user interaction, making it exploitable against exposed cFS deployments used in flight software and ground systems.
Critical Impact
A remote unauthenticated attacker can degrade or halt CFDP file transfer operations on NASA cFS v7.0.1 by replaying final CFDP PDUs.
Affected Products
- NASA Core Flight System (cFS) version 7.0.1
- CFDP receive-path component within cFS
- Downstream mission software incorporating the affected cFS release
Discovery Timeline
- 2026-08-03 - CVE CVE-2026-67973 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-67973
Vulnerability Analysis
The vulnerability resides in how the cFS CFDP receive path processes final PDUs during a file delivery transaction. CFDP is a CCSDS-standardized protocol used to reliably transfer files between spacecraft and ground stations. When an attacker captures and replays a legitimate final PDU, the receiver mishandles the redundant transaction state, leading to resource consumption that prevents further processing.
Because the flaw affects availability of a core spaceflight service, a successful attack can interrupt telemetry, command, and file exchange functions that depend on CFDP. Additional technical context is available in the NASA cFS repository and the associated GitHub Issue #1075.
Root Cause
The root cause is insufficient validation of duplicate or replayed terminal PDUs in the CFDP receive state machine. The receiver does not adequately track completed or aborted transactions, so replayed final PDUs cause repeated processing that exhausts protocol resources. This maps to [CWE-400: Uncontrolled Resource Consumption].
Attack Vector
An attacker with the ability to send CFDP traffic to the affected receiver captures a legitimate final PDU and replays it. No credentials or user action are required. In deployments where CFDP endpoints are reachable across network segments or shared bus interfaces, this lowers the barrier for disruption of file delivery services.
No verified exploit code is publicly available. Refer to the cFS Issue #1075 for maintainer discussion of the defect.
Detection Methods for CVE-2026-67973
Indicators of Compromise
- Repeated identical CFDP final PDUs arriving at a receiver within short time windows
- CFDP transactions terminating abnormally or entering error states without corresponding data PDUs
- Elevated CPU or memory usage in cFS CFDP application tasks without a matching increase in legitimate file transfers
Detection Strategies
- Inspect CFDP traffic for duplicate transaction identifiers and repeated end-of-file or finished PDUs targeting the same entity
- Correlate CFDP application logs with network telemetry to identify replay patterns
- Alert on sudden growth of CFDP transaction table entries or queued PDUs beyond baseline
Monitoring Recommendations
- Enable and forward cFS CFDP event and housekeeping telemetry to a central logging system
- Baseline normal CFDP transaction volumes and PDU sequences per mission profile
- Monitor spacecraft-to-ground and ground-to-ground links for anomalous PDU repetition rates
How to Mitigate CVE-2026-67973
Immediate Actions Required
- Restrict CFDP endpoint reachability to authenticated and authorized peers using network segmentation and access controls
- Track upstream fixes in the NASA cFS repository and apply patches when released
- Review CFDP application configuration to reduce transaction table size limits and timeout windows where operationally feasible
Patch Information
At the time of publication, no fixed cFS release addressing CVE-2026-67973 is listed in the NVD entry. Monitor GitHub Issue #1075 and the cFS repository for remediation guidance and version updates from NASA.
Workarounds
- Deploy link-layer or transport-layer integrity and anti-replay controls in front of CFDP endpoints where mission architecture allows
- Filter or rate-limit duplicate CFDP PDUs at ground station gateways
- Reset or reinitialize the CFDP application if resource exhaustion is observed to restore file delivery service
# Configuration example not available - refer to NASA cFS documentation
# https://github.com/nasa/cFS
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
