Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-54086— SLE API for Java: Uncontrolled Memory Allocation / handled exception leading to Denial of Service

Quick assessment

Affected
esa sleapi-j
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

SLE API for Java 是 CCSDS（空间数据系统咨询委员会）空间链路扩展服务（Space Link Extension Services）的一种实现。在版本 5.1.7 之前，ISP1 PDU（协议数据单元）处理路径在解码攻击者可控的报文体长度时，会分配一个没有上限的字节数组。此外，格式错误或被截断的输入也可能导致读取操作意外终止，从而使未经身份验证的客户端能够针对 SLE 监听服务触发异常、资源泄漏以及拒绝服务（DoS）攻击。该问题已在版本 5.1.7 中得到修复。

CVSS 5.3 · Medium

Affected Version Matrix 1

VendorProduct Version RangeStatus
esa sleapi-j < 5.1.7 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-54086

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
SLE API for Java: Uncontrolled Memory Allocation / handled exception leading to Denial of Service
Source: CVE Program / CVE List V5
Vulnerability Description
SLE API for Java is an implementation of CCSDS Space Link Extension Services. Prior to 5.1.7, the ISP1 PDU handling path decodes an attacker-controlled body length and allocates a byte array without an upper bound, while malformed or truncated input can also terminate reads unexpectedly, allowing an unauthenticated client of the SLE listening service to trigger exceptions, resource leakage, and denial of service. This issue is fixed in version 5.1.7.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
esa sleapi-j < 5.1.7 -

II. Public POCs for CVE-2026-54086

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-54086

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-54086 (1)

Vendor Advisories for CVE-2026-54086 (1)

Vendor Pages for CVE-2026-54086 (1)

IV. Related Vulnerabilities

Same weakness: CWE-770

V. Comments for CVE-2026-54086

No comments yet

Leave a comment