Read the docs
TI-2026-71905 Aliases CVE-2026-54086

Denial of service in SLE API for Java via unbounded allocation

Priority LOW 31CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-770.

Summary

SLE API for Java before 5.1.7 is affected. The ISP1 PDU handling path allocates a byte array sized by an attacker-controlled body length without an upper bound, and malformed or truncated input ends reads unexpectedly (CWE-770). An unauthenticated client of the SLE listening service can trigger exceptions, resource leakage and denial of service.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Description from the CNA

SLE API for Java is an implementation of CCSDS Space Link Extension Services. Prior to 5.1.7, the ISP1 PDU handling path decodes an attacker-controlled body length and allocates a byte array without an upper bound, while malformed or truncated input can also terminate reads unexpectedly, allowing an unauthenticated client of the SLE listening service to trigger exceptions, resource leakage, and denial of service. This issue is fixed in version 5.1.7.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00485 42nd percentileScored 2026-11-07
Fix Fixed sleapi-j (esa): 5.1.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
esasleapi-jbefore 5.1.75.1.7Patch availableCNA
  • sleapi-j Vendoresa Affected before 5.1.7 Fixed in 5.1.7 Patch available CNA

Remediation

Upgrade SLE API for Java to version 5.1.7, the fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

  • Fix · CNA sleapi-j (esa) Fixed in 5.1.7

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-54086
  2. 2026-10-18 CISA SSVC decision points changed

References

Other 3

  • TI-2026-85525 Out-of-bounds write in ASN1SCC decoders for uPER and ACN CVSS 3.1HIGH 8.1
  • TI-2022-12968 The pyesasky for python, as distributed on PyPI, included a code-execution backdoor… CVSS 3.1CRITICAL 9.8
  • TI-2026-85527 Stack buffer overflow in ASN1SCC XER decoder tokenizer CVSS 3.1HIGH 8.1
  • TI-2026-85526 Out-of-bounds read in ASN1SCC ASN.1 string decoders CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences