Description
Vanetza is an open-source implementation of the ETSI C-ITS protocol suite. In 26.02 and earlier, a denial-of-service vulnerability was identified in the ASN.1/OER parsing pipeline of Vanetza. When processing malformed network packets containing corrupted ASN.1/OER structures (e.g., invalid length fields or malformed certificate encoding), the ASN.1 wrapper (asn1c_wrapper.cpp) raises a std::runtime_error. This exception is not caught at the parsing boundary and propagates to std::terminate, resulting in process termination. This vulnerability is fixed with commit 62dfe58a8342512b6e1947d75821402ada524f1a.
Published: 2026-05-26
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability occurs when the Vanetza library processes malformed network packets that contain corrupted ASN.1/OER structures. The ASN.1 wrapper throws a runtime error that is not caught, leading to termination of the process. This flaw is a typical exception‑handling weakness, mapped to CWE‑248, and results in a denial of service for any process that uses the affected parsing code.

Affected Systems

The affected product is the Vanetza open‑source implementation of the ETSI C‑ITS protocol suite, maintained by riebl. Versions 26.02 and earlier are impacted. Users who compile or link against these releases are susceptible until the code is updated.

Risk and Exploitability

The CVSS score of 7.5 indicates a high impact denial of service vulnerability, but no EPSS score is available and the issue is not in the CISA KEV list. An attacker can trigger the failure by sending specially crafted packets over the network, so the attack vector is remote and network‑based. The effect is a hard crash of any service that relies on the vulnerable parser.

Generated by OpenCVE AI on May 26, 2026 at 22:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to a version of Vanetza that contains commit 62dfe58a or later to address the unchecked exception.
  • If an upgrade is not immediately possible, restrict inbound traffic to the parsing endpoint using firewall rules or rate limiting to reduce the opportunity for malformed packet injection.
  • Install a watchdog or process monitor that automatically restarts any Vanetza instance that crashes, ensuring minimal service interruption while the underlying code remains patched.

Generated by OpenCVE AI on May 26, 2026 at 22:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 27 May 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 26 May 2026 22:45:00 +0000

Type Values Removed Values Added
First Time appeared Riebl
Riebl vanetza
Vendors & Products Riebl
Riebl vanetza

Tue, 26 May 2026 21:45:00 +0000

Type Values Removed Values Added
Description Vanetza is an open-source implementation of the ETSI C-ITS protocol suite. In 26.02 and earlier, a denial-of-service vulnerability was identified in the ASN.1/OER parsing pipeline of Vanetza. When processing malformed network packets containing corrupted ASN.1/OER structures (e.g., invalid length fields or malformed certificate encoding), the ASN.1 wrapper (asn1c_wrapper.cpp) raises a std::runtime_error. This exception is not caught at the parsing boundary and propagates to std::terminate, resulting in process termination. This vulnerability is fixed with commit 62dfe58a8342512b6e1947d75821402ada524f1a.
Title Vanetza: Remote Denial of Service via Uncaught Exception in ASN.1/OER Parsing
Weaknesses CWE-248
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Riebl Vanetza
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-05-27T18:36:29.364Z

Reserved: 2026-05-04T20:24:31.916Z

Link: CVE-2026-43988

cve-icon Vulnrichment

Updated: 2026-05-27T13:03:10.483Z

cve-icon NVD

Status : Deferred

Published: 2026-05-26T22:16:42.303

Modified: 2026-06-17T10:50:10.113

Link: CVE-2026-43988

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-26T22:30:18Z

Weaknesses