Vulnerabilities in NASA CryptoLib

SecMate reported eight vulnerabilities in NASA CryptoLib . NASA has published six of them as GitHub Security Advisories covering CryptoLib’s KMC crypto service client and MariaDB Security Association handling. Two additional reports remain under review and are not described in this post.

SecMate produced these findings with the automated vulnerability-research engine used across its public disclosures . The engine is built for sovereign deployment on locally deployable language models and does not require sending code to external services. This analysis used GPT-OSS 20B and GPT-OSS 120B.

NASA published the six public advisories on January 9, 2026. Each advisory lists CryptoLib v1.4.3 as the patched version. CryptoLib v1.5.0, released on January 14, 2026, is the latest public GitHub release as of June 17, 2026.

What Is CryptoLib?

CryptoLib is NASA’s software-only C library for applying CCSDS Space Data Link Security to space-communication frames. It helps mission software add or verify security fields on commands sent to spacecraft and telemetry returned by spacecraft.

The public advisories concern:

• KMC crypto service client: code that sends cryptographic-operation requests to an external KMC service and parses HTTP responses. The issues are in response parsing, response buffering, and cleanup paths.
• MariaDB Security Association backend: code that loads Security Associations from a MariaDB database. A Security Association is the record that tells CryptoLib which keys, algorithms, counters, and frame fields apply to protected traffic. The issue is in decoding hex-encoded database fields into fixed-size buffers.

Advisory Map

Affected Builds and Use Cases

For these six advisories, affected deployments are those running CryptoLib v1.4.2 or earlier with the KMC crypto service client or MariaDB Security Association backend in use.

For KMC, the relevant input is the HTTP response returned to CryptoLib by the external KMC crypto service. A malicious, compromised, or untrusted KMC endpoint can trigger the response parsing and response buffering issues. The KMC success-path memory leak can also affect normal repeated use because it does not require a malicious response.

For MariaDB, the relevant input is the SA database content. Oversized hex-encoded fields can overflow destination buffers during Security Association loading if an attacker can alter database rows, compromise provisioning, or feed malformed SA material into the backend.

KMC Client Issues

Five public advisories affect src/crypto/kmc/cryptography_interface_kmc_crypto_service.template.c.

Two are out-of-bounds reads in metadata parsing in the standard encrypt and AEAD encrypt paths. Both come from resuming strtok parsing by pointer arithmetic on the previous token, which can advance past the end of short or malformed metadata.

Two are memory leaks: one on the encrypt success path, and one on HTTP error paths that return after a non-200 response without releasing prior allocations.

The fifth KMC advisory covers unbounded HTTP response buffering. The libcurl write callback grows the response buffer with realloc without a response-size limit, so a large response can force excessive allocation and terminate or stall the process.

MariaDB SA Backend Issue

One public advisory affects src/sa/mariadb/sa_interface_mariadb.template.c.

CryptoLib’s MariaDB backend loads Security Association fields from database rows. Some fields are hex-encoded and decoded into fixed-size buffers in the SA structure. In affected versions, the converter did not check the destination buffer capacity before writing decoded bytes. Oversized hex fields could overrun fields such as IV, ARSN, ABM, or cipher configuration buffers during SA load.

The patched code adds a maximum-length argument to the converter and checks source length against destination capacity before writing.

Recommendations

For these six advisories, NASA lists versions up to and including v1.4.2 as affected and v1.4.3 as patched. CryptoLib v1.5.0 was released shortly after v1.4.3.

• Update CryptoLib to v1.4.3 or later. Prefer the latest public release where compatibility allows.
• If CryptoLib is vendored or forked, check that the KMC and MariaDB fixes from v1.4.3 are present.
• For KMC deployments, review how the KMC endpoint is authenticated, isolated, and monitored.
• For MariaDB-backed SA storage, review who can write or provision SA rows.

Timeline

References

• [1] NASA. “CryptoLib.” GitHub repository. Repository

• [2] NASA. “Security Advisories.” CryptoLib. Advisories

• [3] NASA. “Releases.” CryptoLib. Releases

• [4] NASA. “Out-of-Bounds Read in KMC AEAD Encrypt Metadata Parsing via Flawed strtok Pattern.” GitHub Security Advisory. GHSA-8w3h-q8jm-3chq

• [5] NASA. “Out-of-Bounds Read in KMC Encrypt Metadata Parsing via Flawed strtok Pattern.” GitHub Security Advisory. GHSA-4g6v-36fv-qcvw

• [6] NASA. “Memory Leak in KMC Encrypt Function Leads to Resource Exhaustion.” GitHub Security Advisory. GHSA-r3wg-g8xv-gxvf

• [7] NASA. “Memory Leak on HTTP Error Response in KMC Client.” GitHub Security Advisory. GHSA-h74x-vwwr-mm5g

• [8] NASA. “Unbounded Memory Allocation in KMC HTTP Response Handler Allows Resource Exhaustion.” GitHub Security Advisory. GHSA-w9cm-q69w-34x7

• [9] NASA. “Heap Buffer Overflow in MariaDB SA Hexstring Conversion.” GitHub Security Advisory. GHSA-3m35-m689-h29x

• [10] NASA. “KMC crypto service interface.” CryptoLib source. Source

• [11] NASA. “MariaDB SA interface.” CryptoLib source. Source

The SecMate Team