# CVE-2026-71647: EGO-Planner-v2 denial of service in recovery state machine

Source: https://junglewise.ai/threats/cve-2026-71647-ego-planner-v2-denial-of-service-in-recovery-state-machine  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-10. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-71647 · Severity: high · CVSS 7.5 · Published 2026-09-10

EGO-Planner-v2 is a path-planning library used in autonomous aerial vehicle (UAV) swarms to avoid obstacles and coordinate multi-robot motion. A flaw in its replanning state machine can trap UAVs in repeated emergency-stop and recovery loops when near obstacles, causing them to fail to resume normal operation and preventing mission completion across the swarm.

Technologies: [ZJU-FAST-Lab EGO-Planner-v2](https://junglewise.ai/threats/technologies/ego-planner-v2). Vendors: [ZJU-FAST-Lab](https://junglewise.ai/threats/vendors/zju-fast-lab).

## Quick answers

**Is CVE-2026-71647 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-71647 being exploited in the wild.

**How severe is CVE-2026-71647?** High severity, with a CVSS score of 7.5, published 10 September 2026.

**Which products and versions are affected?** ZJU-FAST-Lab EGO-Planner-v2 all versions up to commit 5c99a95880401e2599638d567abc0e240396cb42.

**Is there a fix for CVE-2026-71647?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-71647 attacked?** It is attacked from the adjacent network, in a software library.

**Am I affected by CVE-2026-71647?** Check whether you run ZJU-FAST-Lab EGO-Planner-v2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a denial-of-service condition caused by unbounded oscillation in the finite state machine (FSM) controlling UAV recovery and replanning. The root cause involves three interacting components in ego_replan_fsm.cpp: checkCollisionCallback() runs continuously even during recovery states and repeatedly detects unresolved obstacle conflicts; execFSMCallback() transitions from EMERGENCY_STOP to GEN_NEW_TRAJ based only on velocity drop (odom_vel_.norm() < 0.1) without verifying the underlying conflict is resolved; and planFromGlobalTraj() failures trigger immediate retries without bounded backoff or cooldown. When a UAV remains near an obstacle or another UAV, these mechanisms interact to create a persistent recovery loop where safety checks continuously interrupt recovery attempts. In multi-UAV scenarios, several vehicles can simultaneously enter the same oscillatory recovery behavior, amplifying the denial of service. The vulnerability affects all versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 and is triggered by proximity to obstacles or swarm members with no special authentication required.

## Affected products

- ZJU-FAST-Lab EGO-Planner-v2 all versions up to commit 5c99a95880401e2599638d567abc0e240396cb42

## Timeline

- 2026-09-10: disclosed

## References

- [https://gist.github.com/DongJiaxin0422/1bd1523591973e7c2e1bea862669d343](https://gist.github.com/DongJiaxin0422/1bd1523591973e7c2e1bea862669d343)
- [https://github.com/ZJU-FAST-Lab/EGO-Planner-v2](https://github.com/ZJU-FAST-Lab/EGO-Planner-v2)

## Related threats

- [ZJU-FAST-Lab EGO-Planner-v2 denial of service in emergency recovery logic](https://junglewise.ai/threats/cve-2026-71641-zju-fast-lab-ego-planner-v2-denial-of-service-in-emergency)
- [ZJU-FAST-Lab EGO-Planner-v2 denial of service in recovery logic](https://junglewise.ai/threats/cve-2026-71643-zju-fast-lab-ego-planner-v2-denial-of-service-in-recovery-logic)
- [ZJU-FAST-Lab EGO-Planner-v2 denial of service in collision check](https://junglewise.ai/threats/cve-2026-71642-zju-fast-lab-ego-planner-v2-denial-of-service-in-collision-check)
- [ZJU-FAST-Lab EGO-Planner-v2 unsafe vehicle motion via expired trajectory handling](https://junglewise.ai/threats/cve-2026-71640-zju-fast-lab-ego-planner-v2-unsafe-vehicle-motion-via-expired)