EUVD-2026-26671Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
4DescriptionCVE.org
An issue was discovered in Vanetza V2X v26.02 allowing remote unauthorized attackers to cause a denial of service. The vulnerability exists in the GeoNetworking packet processing pipeline where OpenSSL exceptions from ECC point validation (invalid compressed point, point not on curve) are not properly caught by the Router::indicate() call chain. The openssl_wrapper.cpp check() function (line 19) throws openssl::Exception when OpenSSL operations fail. The parser's catch block in parse_secured() should catch these, but the exception escapes through subsequent processing stages (indicate_common, indicate_extended). This causes std::terminate, crashing the V2X receiver.
AnalysisAI
Remote unauthenticated denial of service crashes Vanetza V2X v26.02 receivers via malformed GeoNetworking packets containing invalid ECC points. Uncaught OpenSSL exceptions from elliptic curve point validation (invalid compressed points, points not on curve) in the security layer escape through the Router::indicate() call chain, triggering std::terminate and process termination. No public exploit identified at time of analysis, though EPSS risk assessment unavailable. Attack requires only network access to the V2X receiver endpoint with no authentication or user interaction (CVSS AV:N/AC:L/PR:N/UI:N), making this a significant operational risk for deployed V2X infrastructure relying on continuous availability for vehicle safety communications.
Technical ContextAI
Vanetza is an open-source C++ implementation of the ETSI ITS-G5 protocol stack for vehicular V2X (vehicle-to-everything) communication, handling GeoNetworking and security layers defined in ETSI standards. The vulnerability originates in the integration between the security layer's certificate validation (using OpenSSL for ECC operations) and the GeoNetworking router's packet processing pipeline. When parsing secured V2X messages, the openssl_wrapper.cpp check() function (line 19) throws openssl::Exception for OpenSSL operation failures during ECC point validation. While parse_secured() contains a catch block intended to handle these exceptions, the exception propagates uncaught through subsequent processing stages (indicate_common, indicate_extended) in router.cpp. C++ exception handling semantics dictate that an uncaught exception invokes std::terminate, causing immediate process termination. This represents a failure in exception handling hygiene across layer boundaries in the codebase, where security layer exceptions are not properly translated into error returns or caught at architectural boundaries before reaching the router's processing core.
RemediationAI
Primary mitigation requires code-level fix to ensure OpenSSL exceptions from ECC point validation are caught before reaching Router::indicate() processing stages. Organizations should monitor the Vanetza GitHub repository (github.com/riebl/vanetza) for security patches addressing exception handling in the GeoNetworking-security layer boundary. Until a vendor-confirmed patch is available, implement defense-in-depth compensating controls: (1) Deploy network-layer filtering to validate V2X packet structure before reaching the Vanetza parser-reject packets with obviously malformed security headers or invalid ECC point encodings at firewall/preprocessor level, though this requires deep packet inspection capability for ETSI ITS-G5 protocols. (2) Implement process supervision and automatic restart mechanisms (systemd watchdog, container orchestration health checks) to minimize downtime from crashes-this does not prevent exploitation but reduces availability impact to seconds rather than sustained outage. Trade-off: automatic restart may mask ongoing attacks and generate alert fatigue. (3) Enable comprehensive logging of OpenSSL errors and packet validation failures to detect exploitation attempts, correlating crash events with malformed packet sources for incident response. (4) For non-production deployments, consider running Vanetza in sandboxed environments with resource limits to contain crash impact. Contact the Vanetza project maintainers directly via GitHub issues for clarification on fix timeline and affected version scope.
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to se
The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig
The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before
In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
Same weakness CWE-248 – Uncaught Exception
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today