Vulnerability in SLE API for Java by ESA Exposes Applications to Denial of Service

CVE-2026-54086

What is CVE-2026-54086?

The SLE API for Java, released by ESA, contains a vulnerability that allows attackers to exploit the ISP1 PDU handling path. This flaw permits manipulation of the body length from attacker-controlled input, leading to the allocation of a byte array without an upper limit. Additionally, malformed or truncated data can cause unexpected termination of read operations. This vulnerability can be exploited by unauthenticated clients of the SLE listening service, resulting in exception triggers, resource leakage, and ultimately causing a denial of service. Users are encouraged to upgrade to version 5.1.7, where the issue has been resolved.

References