Vanetza, an open‑source ETSI C‑ITS protocol suite, has a logic failure in its cryptographic verification pipeline. The ASN.1 decoder accepts incoming V2X messages as syntactically valid but does not enforce semantic constraints on certificate fields until later re‑encoding via OER. A crafted packet containing a certificate with a violated Psid subtype passes the initial parse, and when StraightVerifyService attempts to re‑encode the certificate a std::runtime_error is thrown. Because the exception is uncaught, std::terminate is invoked and the Vanetza process exits immediately. The outcome is a denial‑of‑service that interrupts the service’s availability. This weakness is classified as CWE‑248.

The affected product is Vanetza from the vendor riebl. Versions 26.02 and all earlier releases are vulnerable. The vulnerability is fixed by applying commit e1a2e2709210d309458c3d77f98d50dec26c0df0, or by upgrading to a newer release that contains the fix.

The CVSS score of 7.5 indicates a high‑severity impact. No EPSS information is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that no widespread exploitation has been observed to date. Nonetheless, the attack can be triggered by an attacker who can inject malicious V2X traffic into the target system; authentication or complex prerequisites are not required. Once crafted traffic is delivered, the vulnerable process will terminate without any mitigations in place, causing an immediate outage. The threat remains largely limited to denial of service, but the exploitability is high due to the lack of defensive checks.