Executive brief
Vanetza is an open-source software library used for implementing communication protocols in Intelligent Transport Systems (ITS), such as connected vehicle technology. A security flaw allows a remote attacker to crash the software by sending a specially crafted network packet. This results in a denial-of-service, potentially disabling critical vehicle-to-everything (V2X) communication services until the process is restarted.
Technical details
A denial-of-service vulnerability exists in Vanetza's ASN.1/OER parsing pipeline due to an uncaught exception (CWE-248). When the `asn1c_wrapper.cpp` component processes malformed network packets—such as those with invalid length fields or corrupted certificate encodings—it raises a `std::runtime_error`. Because this exception is not caught at the parsing boundary, it propagates to `std::terminate`, causing the entire process to abort. The vulnerability is reachable via the `Router::indicate` entry point and requires no authentication. A fix is available in commit 62dfe58a8342512b6e1947d75821402ada524f1a, which introduces proper try-catch blocks during certificate canonicalization.
Affected products
- riebl Vanetza 26.02 and earlier
Timeline
- 2026-05-06: advisory: GitHub Security Advisory published
- 2026-05-26: disclosed: CVE published to NVD