CVE-2026-54086

MEDIUM 5.3

SLE API for Java: Uncontrolled Memory Allocation / handled exception leading to Denial of Service

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

SLE API for Java is an implementation of CCSDS Space Link Extension Services. Prior to 5.1.7, the ISP1 PDU handling path decodes an attacker-controlled body length and allocates a byte array without an upper bound, while malformed or truncated input can also terminate reads unexpectedly, allowing an unauthenticated client of the SLE listening service to trigger exceptions, resource leakage, and denial of service. This issue is fixed in version 5.1.7.

CWE	CWE-770
Vendor	esa
Product	sleapi-j
Published	Oct 13, 2026

Stay Ahead of the Next One

Get instant alerts for esa sleapi-j

Be the first to know when new medium vulnerabilities affecting esa sleapi-j are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Affected Versions

esa / sleapi-j

< 5.1.7

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/esa/sleapi-j/security/advisories/GHSA-6g75-jwgj-hj8v github.com: https://github.com/esa/sleapi-j/commit/265118dfb70d1d0d991b085dcde4028c60bce4fc github.com: https://github.com/esa/sleapi-j/releases/tag/5.1.7