Security readout for executives and security teams
Plain-English summary
CryptoLib before 1.4.3 can slowly leak memory when its KMC server returns HTTP errors. In systems using CryptoLib for spacecraft-to-ground security, repeated failed KMC requests could reduce availability over time. The issue is patched in version 1.4.3.
Executive priority
Treat as a targeted availability risk for mission or operational systems using CryptoLib KMC. Prioritize upgrade during the next controlled maintenance window, sooner if affected systems show repeated KMC errors or constrained memory.
Technical view
In NASA CryptoLib <1.4.3, cryptography_encrypt() and cryptography_decrypt() return early on non-200 KMC HTTP responses without freeing allocated buffers. Each failed request leaks about 467 bytes. The CVE maps to CWE-401 and CWE-770 and has CVSS 4.0 score 6.3 with network attack vector and low availability impact.
Likely exposure
Exposure is limited to deployments using NASA CryptoLib versions before 1.4.3 with KMC client functionality. Systems repeatedly receiving non-200 responses from the KMC server, whether from network faults or a malicious server, are the relevant concern.
Exploitation context
The source bundle does not report active exploitation, and the CVE is not listed as KEV. Abuse would require repeated failed KMC interactions to accumulate memory leakage. Impact is availability degradation, not disclosed confidentiality or integrity compromise.
Researcher notes
Evidence is from the GitHub advisory, CVE record, release, and fixing commit. The public sources describe the leak size, error condition, affected versions, and patch version. They do not provide evidence of exploitation in the wild.
Mitigation direction
- Upgrade NASA CryptoLib to version 1.4.3 or later.
- Review vendor advisory and release notes before deployment.
- Investigate recurring KMC non-200 HTTP responses in affected environments.
- Monitor memory use in CryptoLib processes until upgraded.
Validation and detection
- Inventory CryptoLib versions and identify instances below 1.4.3.
- Confirm whether KMC client functions are enabled or used.
- Review logs for repeated KMC non-200 HTTP responses.
- Verify upgraded systems report CryptoLib version 1.4.3 or later.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-401: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-770: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-22025 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
6.3MediumVector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/nasa/CryptoLib/security/advisories/GHSA-h74x-vwwr-mm5gCVE reference · x_refsource_CONFIRM
- https://github.com/nasa/CryptoLib/commit/2372efd3da1ccb226b4297222e25f41ecc84821dCVE reference · x_refsource_MISC
- https://github.com/nasa/CryptoLib/releases/tag/v1.4.3CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Release of Memory after Effective Lifetime
Missing Release of Memory after Effective Lifetime represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.