All vulnerabilities
CVE-2026-54086GHSA-6g75-jwgj-hj8v

sleapi-j: SLE API for Java: Uncontrolled Memory Allocation / handled exception leading to Denial of Service

esa sleapi-j
Open in ThreatlineRecord JSON
CVSS
5.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.48%Chance of exploitation activity in the next 30 days, higher than 40% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in5.1.7Fixed versionGitHub
Published13 Oct 2026Updated 16 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

SLE API for Java is an implementation of CCSDS Space Link Extension Services. Prior to 5.1.7, the ISP1 PDU handling path decodes an attacker-controlled body length and allocates a byte array without an upper bound, while malformed or truncated input can also terminate reads unexpectedly, allowing an unauthenticated client of the SLE listening service to trigger exceptions, resource leakage, and denial of service. This issue is fixed in version 5.1.7.

Text from CVE List

Affected versions 2

  • sleapi-jaffected: < 5.1.7CVE List
  • sleapi-j< 5.1.7GitHub

References 3