CVE-2026-37554

Denial of Service via Unchecked OpenSSL Exceptions in Vanetza V2X

Published May 1, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

An issue was discovered in Vanetza V2X v26.02 allowing remote unauthorized attackers to cause a denial of service. The vulnerability exists in the GeoNetworking packet processing pipeline where OpenSSL exceptions from ECC point validation (invalid compressed point, point not on curve) are not properly caught by the Router::indicate() call chain. The openssl_wrapper.cpp check() function (line 19) throws openssl::Exception when OpenSSL operations fail. The parser's catch block in parse_secured() should catch these, but the exception escapes through subsequent processing stages (indicate_common, indicate_extended). This causes std::terminate, crashing the V2X receiver.

Analysis

Technical impact

Vanetza V2X v26.02 contains a defect in the GeoNetworking packet parser where OpenSSL exceptions thrown during ECC point validation are not fully caught. The exception propagates through the Router::indicate() call chain, ultimately causing std::terminate and crashing the receiver process. Attackers can exploit this remotely, sending crafted packets to trigger the exception and bring the V2X service down, disrupting critical vehicle‑to‑vehicle communications.

Affected Systems

The vulnerability affects installations of Vanetza V2X version 26.02. Any system running this specific release is susceptible; newer releases after 26.02 are not mentioned.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity impact. Although an EPSS score is not provided, the lack of a KEV listing suggests no currently documented exploits. The attack vector is inferred to be remote, as the payload is delivered over the network to the IPv6 GeoNetworking stack.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

affected

Version	Status	Constraints
`n/a`	affected	—

No data.

Vendor Product Versions

Riebl

Vanetza

Version	Status	Scheme	Platform
`26.02`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Vanetza to a version that includes the fixed exception handling in the GeoNetworking module.
If an upgrade is not immediately possible, apply a local code patch that surrounds the OpenSSL operations in check() with a try/catch to swallow openssl::Exception and prevents std::terminate.
Configure network controls to limit or inspect incoming GeoNetworking packets, reducing the opportunity for crafted packets to reach the vulnerable layer.

Generated by OpenCVE AI on May 2, 2026 at 07:56 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.350% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://gist.github.com/sgInnora/45128ae15d52df7238680a8f2da8359f
https://github.com/riebl/vanetza
https://github.com/riebl/vanetza/blob/master/vanetza/geonet/router.cpp
https://github.com/riebl/vanetza/blob/master/vanetza/security/openssl_wrapper.cpp
https://github.com/riebl/vanetza/security/advisories/GHSA-44qj-vh8c-5354

History

May 7, 2026 7:00 PM Added references View changes

Type	Values Removed	Values Added
References		https://github.com/riebl/vanetza/security/advisories/GHSA-44qj-vh8c-5354

May 4, 2026 8:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Riebl Riebl vanetza
Vendors & Products		Riebl Riebl vanetza

May 2, 2026 8:15 AM Title updated View changes

Type	Values Removed	Values Added
Title		Denial of Service via Unchecked OpenSSL Exceptions in Vanetza V2X

May 1, 2026 8:15 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-248
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

May 1, 2026 4:15 PM Description updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		An issue was discovered in Vanetza V2X v26.02 allowing remote unauthorized attackers to cause a denial of service. The vulnerability exists in the GeoNetworking packet processing pipeline where OpenSSL exceptions from ECC point validation (invalid compressed point, point not on curve) are not properly caught by the Router::indicate() call chain. The openssl_wrapper.cpp check() function (line 19) throws openssl::Exception when OpenSSL operations fail. The parser's catch block in parse_secured() should catch these, but the exception escapes through subsequent processing stages (indicate_common, indicate_extended). This causes std::terminate, crashing the V2X receiver.
References		https://gist.github.com/sgInnora/45128ae15d52df7238680a8f2da8359f https://github.com/riebl/vanetza https://github.com/riebl/vanetza/blob/master/vanetza/geonet/router.cpp https://github.com/riebl/vanetza/blob/master/vanetza/security/openssl_wrapper.cpp
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N'}`