Executive brief
Vanetza is an open-source software library used for vehicle-to-everything (V2X) communications, enabling vehicles to exchange safety and traffic information. A flaw in how the library handles incoming messages allows a remote attacker to crash the software by sending a single specially crafted network packet. This results in a complete denial of service, potentially disabling critical communication features in affected automotive systems.
Technical details
A denial-of-service vulnerability exists in Vanetza's cryptographic verification pipeline due to an uncaught exception. While the initial ASN.1 decoder accepts certain V2X messages as syntactically valid, semantic constraints on the Provider Service Identifier (Psid) field are only enforced during subsequent OER re-encoding. When 'StraightVerifyService' attempts to calculate a message hash, the underlying 'asn1c_wrapper.cpp' detects a constraint violation (such as an out-of-range value) and throws a 'std::runtime_error'. Because this exception is not caught, it propagates to 'std::terminate', causing the process to abort. An unauthenticated remote attacker can trigger this crash with a single crafted packet before signature verification occurs. The issue is fixed in commit e1a2e2709210d309458c3d77f98d50dec26c0df0.
Affected products
- riebl Vanetza 26.02 and earlier
Timeline
- 2026-05-09: advisory: GitHub Security Advisory published
- 2026-05-26: disclosed: CVE published to NVD
- 2026-05-26: patched: Fix committed to repository