Vulnerability · Published May 26, 2026 · Assigned by GitHub_M

CVE-2026-43988Vanetza: Remote Denial of Service via Uncaught Exception in ASN.1/OER Parsing

High 7.5

In plain English

A high-severity security flaw in vanetza from riebl. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.2%top 92.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Vanetza is an open-source implementation of the ETSI C-ITS protocol suite. In 26.02 and earlier, a denial-of-service vulnerability was identified in the ASN.1/OER parsing pipeline of Vanetza. When processing malformed network packets containing corrupted ASN.1/OER structures (e.g., invalid length fields or malformed certificate encoding), the ASN.1 wrapper (asn1c_wrapper.cpp) raises a std::runtime_error. This exception is not caught at the parsing boundary and propagates to std::terminate, resulting in process termination. This vulnerability is fixed with commit 62dfe58a8342512b6e1947d75821402ada524f1a.

Affected products (as reported)

Vendor	Product	Versions
riebl	vanetza	< 62dfe58a8342512b6e1947d75821402ada524f1a<= 26.02

Weakness: CWE-248 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/riebl/vanetza/security/advisories/GHSA-j6cj-rp87-mfrx x_refsource_CONFIRM
https://github.com/riebl/vanetza/commit/62dfe58a8342512b6e1947d75821402ada524f1a x_refsource_MISC