CVE-2026-44905 (GCVE-0-2026-44905)

Vulnerability from cvelistv5 – Published: 2026-05-26 21:18 – Updated: 2026-05-27 13:01
VLAI
Title
Vanetza: Remote Denial of Service via Uncaught OER Encoding Exception in Cryptographic Verification
Summary
Vanetza is an open-source implementation of the ETSI C-ITS protocol suite. In 26.02 and earlier, a denial-of-service vulnerability was identified in the cryptographic verification pipeline of Vanetza. When processing incoming V2X messages, the ASN.1 decoder accepts the structure as syntactically valid. However, this reveals a logic-based protocol failure where semantic constraints on specific fields are only strictly enforced during OER re-encoding. Specifically, if a crafted packet contains a certificate where the Psid (Provider Service Identifier) sub-type violates subtype constraints (e.g., out-of-range or invalid CHOICE variant), it is accepted during initial parsing, where subtype constraints are not enforced. Later, when StraightVerifyService attempts to calculate a message hash for cryptographic verification, it must re-encode the signing certificate. The underlying ASN.1 wrapper (asn1c_wrapper.cpp) detects the semantic violation during encoding and raises a std::runtime_error. This exception is not caught within the encoding path and propagates to std::terminate, resulting in immediate process termination. This vulnerability is fixed with commit e1a2e2709210d309458c3d77f98d50dec26c0df0.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: poc Automatable: yes Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
riebl vanetza Affected: < e1a2e2709210d309458c3d77f98d50dec26c0df0
Affected: <= 26.02
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-44905",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-27T13:01:15.575636Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-27T13:01:57.541Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/riebl/vanetza/security/advisories/GHSA-q9fq-3rx9-7xcv"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vanetza",
          "vendor": "riebl",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c e1a2e2709210d309458c3d77f98d50dec26c0df0"
            },
            {
              "status": "affected",
              "version": "\u003c= 26.02"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vanetza is an open-source implementation of the ETSI C-ITS protocol suite. In 26.02 and earlier, a denial-of-service vulnerability was identified in the cryptographic verification pipeline of Vanetza. When processing incoming V2X messages, the ASN.1 decoder accepts the structure as syntactically valid. However, this reveals a logic-based protocol failure where semantic constraints on specific fields are only strictly enforced during OER re-encoding. Specifically, if a crafted packet contains a certificate where the Psid (Provider Service Identifier) sub-type violates subtype constraints (e.g., out-of-range or invalid CHOICE variant), it is accepted during initial parsing, where subtype constraints are not enforced. Later, when StraightVerifyService attempts to calculate a message hash for cryptographic verification, it must re-encode the signing certificate. The underlying ASN.1 wrapper (asn1c_wrapper.cpp) detects the semantic violation during encoding and raises a std::runtime_error. This exception is not caught within the encoding path and propagates to std::terminate, resulting in immediate process termination. This vulnerability is fixed with commit e1a2e2709210d309458c3d77f98d50dec26c0df0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "CWE-248: Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-26T21:18:33.445Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/riebl/vanetza/security/advisories/GHSA-q9fq-3rx9-7xcv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/riebl/vanetza/security/advisories/GHSA-q9fq-3rx9-7xcv"
        },
        {
          "name": "https://github.com/riebl/vanetza/commit/e1a2e2709210d309458c3d77f98d50dec26c0df0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/riebl/vanetza/commit/e1a2e2709210d309458c3d77f98d50dec26c0df0"
        }
      ],
      "source": {
        "advisory": "GHSA-q9fq-3rx9-7xcv",
        "discovery": "UNKNOWN"
      },
      "title": "Vanetza: Remote Denial of Service via Uncaught OER Encoding Exception in Cryptographic Verification"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-44905",
    "datePublished": "2026-05-26T21:18:33.445Z",
    "dateReserved": "2026-05-07T21:50:33.547Z",
    "dateUpdated": "2026-05-27T13:01:57.541Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-44905",
      "date": "2026-07-24",
      "epss": "0.00202",
      "percentile": "0.10338"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-44905\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-05-26T22:16:43.150\",\"lastModified\":\"2026-07-24T12:10:00.210\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Vanetza is an open-source implementation of the ETSI C-ITS protocol suite. In 26.02 and earlier, a denial-of-service vulnerability was identified in the cryptographic verification pipeline of Vanetza. When processing incoming V2X messages, the ASN.1 decoder accepts the structure as syntactically valid. However, this reveals a logic-based protocol failure where semantic constraints on specific fields are only strictly enforced during OER re-encoding. Specifically, if a crafted packet contains a certificate where the Psid (Provider Service Identifier) sub-type violates subtype constraints (e.g., out-of-range or invalid CHOICE variant), it is accepted during initial parsing, where subtype constraints are not enforced. Later, when StraightVerifyService attempts to calculate a message hash for cryptographic verification, it must re-encode the signing certificate. The underlying ASN.1 wrapper (asn1c_wrapper.cpp) detects the semantic violation during encoding and raises a std::runtime_error. This exception is not caught within the encoding path and propagates to std::terminate, resulting in immediate process termination. This vulnerability is fixed with commit e1a2e2709210d309458c3d77f98d50dec26c0df0.\"},{\"lang\":\"es\",\"value\":\"Vanetza es una implementaci\u00f3n de c\u00f3digo abierto de la suite de protocolos ETSI C-ITS. En la versi\u00f3n 26.02 y anteriores, se identific\u00f3 una vulnerabilidad de denegaci\u00f3n de servicio en la cadena de verificaci\u00f3n criptogr\u00e1fica de Vanetza. Al procesar mensajes V2X entrantes, el decodificador ASN.1 acepta la estructura como sint\u00e1cticamente v\u00e1lida. Sin embargo, esto revela un fallo de protocolo basado en l\u00f3gica donde las restricciones sem\u00e1nticas en campos espec\u00edficos solo se aplican estrictamente durante la recodificaci\u00f3n OER. Espec\u00edficamente, si un paquete manipulado contiene un certificado donde el subtipo Psid (Identificador de Servicio del Proveedor) viola las restricciones de subtipo (por ejemplo, fuera de rango o variante CHOICE inv\u00e1lida), es aceptado durante el an\u00e1lisis inicial, donde las restricciones de subtipo no se aplican. M\u00e1s tarde, cuando StraightVerifyService intenta calcular un hash de mensaje para verificaci\u00f3n criptogr\u00e1fica, debe recodificar el certificado de firma. El envoltorio ASN.1 subyacente (asn1c_wrapper.cpp) detecta la violaci\u00f3n sem\u00e1ntica durante la codificaci\u00f3n y lanza un std::runtime_error. Esta excepci\u00f3n no es capturada dentro de la ruta de codificaci\u00f3n y se propaga a std::terminate, lo que resulta en la terminaci\u00f3n inmediata del proceso. Esta vulnerabilidad se corrige con el commit e1a2e2709210d309458c3d77f98d50dec26c0df0.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"riebl\",\"product\":\"vanetza\",\"versions\":[{\"version\":\"\u003c e1a2e2709210d309458c3d77f98d50dec26c0df0\",\"status\":\"affected\"},{\"version\":\"\u003c= 26.02\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-05-27T13:01:15.575636Z\",\"id\":\"CVE-2026-44905\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-248\"}]}],\"references\":[{\"url\":\"https://github.com/riebl/vanetza/commit/e1a2e2709210d309458c3d77f98d50dec26c0df0\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/riebl/vanetza/security/advisories/GHSA-q9fq-3rx9-7xcv\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/riebl/vanetza/security/advisories/GHSA-q9fq-3rx9-7xcv\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "redhat_vex": {
      "current_release_date": "2026-06-05T19:11:30+00:00",
      "cve": "CVE-2026-44905",
      "id": "CVE-2026-44905",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Vanetza: Remote Denial of Service via Uncaught OER Encoding Exception in Cryptographic Verification",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44905.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-44905\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-27T13:01:15.575636Z\"}}}], \"references\": [{\"url\": \"https://github.com/riebl/vanetza/security/advisories/GHSA-q9fq-3rx9-7xcv\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-27T13:01:52.093Z\"}}], \"cna\": {\"title\": \"Vanetza: Remote Denial of Service via Uncaught OER Encoding Exception in Cryptographic Verification\", \"source\": {\"advisory\": \"GHSA-q9fq-3rx9-7xcv\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"riebl\", \"product\": \"vanetza\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c e1a2e2709210d309458c3d77f98d50dec26c0df0\"}, {\"status\": \"affected\", \"version\": \"\u003c= 26.02\"}]}], \"references\": [{\"url\": \"https://github.com/riebl/vanetza/security/advisories/GHSA-q9fq-3rx9-7xcv\", \"name\": \"https://github.com/riebl/vanetza/security/advisories/GHSA-q9fq-3rx9-7xcv\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/riebl/vanetza/commit/e1a2e2709210d309458c3d77f98d50dec26c0df0\", \"name\": \"https://github.com/riebl/vanetza/commit/e1a2e2709210d309458c3d77f98d50dec26c0df0\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Vanetza is an open-source implementation of the ETSI C-ITS protocol suite. In 26.02 and earlier, a denial-of-service vulnerability was identified in the cryptographic verification pipeline of Vanetza. When processing incoming V2X messages, the ASN.1 decoder accepts the structure as syntactically valid. However, this reveals a logic-based protocol failure where semantic constraints on specific fields are only strictly enforced during OER re-encoding. Specifically, if a crafted packet contains a certificate where the Psid (Provider Service Identifier) sub-type violates subtype constraints (e.g., out-of-range or invalid CHOICE variant), it is accepted during initial parsing, where subtype constraints are not enforced. Later, when StraightVerifyService attempts to calculate a message hash for cryptographic verification, it must re-encode the signing certificate. The underlying ASN.1 wrapper (asn1c_wrapper.cpp) detects the semantic violation during encoding and raises a std::runtime_error. This exception is not caught within the encoding path and propagates to std::terminate, resulting in immediate process termination. This vulnerability is fixed with commit e1a2e2709210d309458c3d77f98d50dec26c0df0.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-248\", \"description\": \"CWE-248: Uncaught Exception\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-05-26T21:18:33.445Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-44905\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-27T13:01:57.541Z\", \"dateReserved\": \"2026-05-07T21:50:33.547Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-05-26T21:18:33.445Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.