What is GHSA-64r5-qp28-crvm?

GHSA-64r5-qp28-crvm is a security advisory published by GitHub Security Advisories with High severity. NASA CryptoLib 1.5.0 contains an authentication downgrade vulnerability in the Telecommand (TC)...

Which CVE IDs does GHSA-64r5-qp28-crvm cover?

GHSA-64r5-qp28-crvm covers the following CVE IDs: CVE-2026-79954. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-64r5-qp28-crvmHigh

NASA CryptoLib 1.5.0 contains an authentication downgrade vulnerability in the Telecommand (TC)...

Vendor

GitHub Security Advisories

Published

September 18, 2026

Last Modified

September 18, 2026

🔗 CVE IDs covered (1)

CVE-2026-79954 →

📋 Description

NASA CryptoLib 1.5.0 contains an authentication downgrade vulnerability in the Telecommand (TC) receive path. The receiver selects the Security Association used for SDLS processing solely from the SPI field inside the incoming frame, but it does not verify that the selected SA is authorized for the frame's GVCID.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-79954
https://fluidattacks.com/advisories/linkin
https://github.com/nasa/CryptoLib
https://github.com/advisories/GHSA-64r5-qp28-crvm