The vulnerability in EGO‑Planner‑v2 allows an attacker to cause a denial of service by abusing the checkCollisionCallback, execFSMCallback, and planFromGlobalTraj functions defined in ego_replan_fsm.cpp. When invoked, these callbacks can enter an uncontrolled loop or exhaust system resources, rendering the planner service unresponsive. This flaw does not provide privilege escalation or remote code execution; it merely disrupts the availability of the planner component.

The affected software is the open‑source project EGO‑Planner‑v2 hosted on GitHub at https://github.com/ZJU-FAST-Lab/EGO-Planner-v2. All versions up to and including commit 5c99a95880401e2599638d567abc0e240396cb42 are vulnerable. The project repository and its issue tracker can be found at the provided GitHub URLs.

The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, so the likelihood of exploitation is unknown. The advisory does not specify the exact attack surface or the input conditions required to trigger the vulnerable callbacks; consequently the exploitation path remains unclear. However, since the flaw can lead to service unavailability, deployments that rely on the planner component should consider the risk significant. No proof‑of‑concept exploits have been disclosed.