# CVE-2026-71643: ZJU-FAST-Lab EGO-Planner-v2 denial of service in recovery logic

Source: https://junglewise.ai/threats/cve-2026-71643-zju-fast-lab-ego-planner-v2-denial-of-service-in-recovery-logic  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-10. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-71643 · Severity: high · CVSS 7.5 · Published 2026-09-10

EGO-Planner-v2 is a trajectory planning system for coordinated swarms of micro aerial vehicles. A flaw in its emergency recovery logic can cause multiple UAVs to become permanently stuck in a stopped state, unable to resume flight even after safety conditions improve. This denies swarm availability and prevents mission completion when collisions are detected and emergency stops are triggered.

Technologies: [ZJU-FAST-Lab EGO-Planner-v2](https://junglewise.ai/threats/technologies/ego-planner-v2). Vendors: [ZJU-FAST-Lab](https://junglewise.ai/threats/vendors/zju-fast-lab).

## Quick answers

**Is CVE-2026-71643 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-71643 being exploited in the wild.

**How severe is CVE-2026-71643?** High severity, with a CVSS score of 7.5, published 10 September 2026.

**Which products and versions are affected?** ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42.

**Is there a fix for CVE-2026-71643?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-71643 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-71643?** Check whether you run ZJU-FAST-Lab EGO-Planner-v2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a denial-of-service condition in the EGOReplanFSM recovery component caused by inconsistent collision semantics between the safety checker and trajectory optimizer. The safety checker uses Euclidean distance and base clearance thresholds to determine when recovery is safe, but the optimizer uses an ellipsoidal distance model with stricter clearance margins. After UAVs enter EMERGENCY_STOP and halt, the safety checker may approve recovery planning, yet the optimizer rejects every recovery trajectory because the current configuration still violates its stricter constraints. Additionally, the optimizer reuses expired trajectories by extrapolation; since stopped UAVs have zero velocity, they are treated as permanent static obstacles. When trajectory generation fails repeatedly via planFromGlobalTraj(10), the FSM loops back to GEN_NEW_TRAJ without retry limits or alternative recovery states, causing indefinite retry loops. No patch is yet available; the vulnerability affects all versions up to commit 5c99a95880401e2599638d567abc0e240396cb42.

## Affected products

- ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42

## Timeline

- 2026-09-10: disclosed: Published on NVD

## References

- [https://gist.github.com/DongJiaxin0422/0d9b5d8d3bff919f626ae20040b90727](https://gist.github.com/DongJiaxin0422/0d9b5d8d3bff919f626ae20040b90727)
- [https://github.com/ZJU-FAST-Lab/EGO-Planner-v2](https://github.com/ZJU-FAST-Lab/EGO-Planner-v2)

## Related threats

- [ZJU-FAST-Lab EGO-Planner-v2 denial of service in emergency recovery logic](https://junglewise.ai/threats/cve-2026-71641-zju-fast-lab-ego-planner-v2-denial-of-service-in-emergency)
- [EGO-Planner-v2 denial of service in recovery state machine](https://junglewise.ai/threats/cve-2026-71647-ego-planner-v2-denial-of-service-in-recovery-state-machine)
- [ZJU-FAST-Lab EGO-Planner-v2 denial of service in collision check](https://junglewise.ai/threats/cve-2026-71642-zju-fast-lab-ego-planner-v2-denial-of-service-in-collision-check)
- [ZJU-FAST-Lab EGO-Planner-v2 unsafe vehicle motion via expired trajectory handling](https://junglewise.ai/threats/cve-2026-71640-zju-fast-lab-ego-planner-v2-unsafe-vehicle-motion-via-expired)