# CVE-2026-71641: ZJU-FAST-Lab EGO-Planner-v2 denial of service in emergency recovery logic

Source: https://junglewise.ai/threats/cve-2026-71641-zju-fast-lab-ego-planner-v2-denial-of-service-in-emergency  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-11. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-71641 · Severity: high · CVSS 7.5 · Published 2026-09-11

EGO-Planner-v2 is a path-planning system used to coordinate autonomous micro-flying robots (drones) in swarm operations. A flaw in the emergency recovery mechanism can cause a drone to become permanently stuck in emergency-stop mode after completing a trajectory, rendering it unable to resume normal flight operations and potentially disabling multiple coordinated vehicles in a multi-drone mission.

Technologies: [ZJU-FAST-Lab EGO-Planner-v2](https://junglewise.ai/threats/technologies/ego-planner-v2). Vendors: [ZJU-FAST-Lab](https://junglewise.ai/threats/vendors/zju-fast-lab).

## Quick answers

**Is CVE-2026-71641 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-71641 being exploited in the wild.

**How severe is CVE-2026-71641?** High severity, with a CVSS score of 7.5, published 11 September 2026.

**Which products and versions are affected?** ZJU-FAST-Lab EGO-Planner-v2 all versions up to commit 5c99a95880401e2599638d567abc0e240396cb42.

**Is there a fix for CVE-2026-71641?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-71641 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-71641?** Check whether you run ZJU-FAST-Lab EGO-Planner-v2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a denial-of-service deadlock in the interaction between three components: traj_server (trajectory publishing), poscmd_2_odom (odometry conversion), and EGOReplanFSM (finite state machine for emergency recovery). When a trajectory ends, traj_server stops publishing position commands but fails to send a final zero-velocity command. poscmd_2_odom then indefinitely reuses the last PositionCommand (which contains non-zero velocity), causing stale velocity data to persist in the odometry. The FSM's recovery from EMERGENCY_STOP requires velocity norm < 0.1, but this condition is never met because the stale velocity remains latched. This creates a permanent deadlock preventing the planner from resuming trajectory generation. The root cause is inconsistent state handling across trajectory completion, command caching, and recovery logic; no patch information is provided in the advisory.

## Affected products

- ZJU-FAST-Lab EGO-Planner-v2 all versions up to commit 5c99a95880401e2599638d567abc0e240396cb42

## Timeline

- 2026-09-11: disclosed

## References

- [https://gist.github.com/DongJiaxin0422/91656fd120c49a779992aba62c1d58af](https://gist.github.com/DongJiaxin0422/91656fd120c49a779992aba62c1d58af)
- [https://github.com/ZJU-FAST-Lab/EGO-Planner-v2](https://github.com/ZJU-FAST-Lab/EGO-Planner-v2)

## Related threats

- [EGO-Planner-v2 denial of service in recovery state machine](https://junglewise.ai/threats/cve-2026-71647-ego-planner-v2-denial-of-service-in-recovery-state-machine)
- [ZJU-FAST-Lab EGO-Planner-v2 denial of service in recovery logic](https://junglewise.ai/threats/cve-2026-71643-zju-fast-lab-ego-planner-v2-denial-of-service-in-recovery-logic)
- [ZJU-FAST-Lab EGO-Planner-v2 denial of service in collision check](https://junglewise.ai/threats/cve-2026-71642-zju-fast-lab-ego-planner-v2-denial-of-service-in-collision-check)
- [ZJU-FAST-Lab EGO-Planner-v2 unsafe vehicle motion via expired trajectory handling](https://junglewise.ai/threats/cve-2026-71640-zju-fast-lab-ego-planner-v2-unsafe-vehicle-motion-via-expired)