CVE-2026-44905

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44905", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-07T21:50:33.547Z", "datePublished": "2026-05-26T21:18:33.445Z", "dateUpdated": "2026-05-27T13:01:57.541Z"}, "containers": {"cna": {"title": "Vanetza: Remote Denial of Service via Uncaught OER Encoding Exception in Cryptographic Verification", "problemTypes": [{"descriptions": [{"cweId": "CWE-248", "lang": "en", "description": "CWE-248: Uncaught Exception", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/riebl/vanetza/security/advisories/GHSA-q9fq-3rx9-7xcv", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/riebl/vanetza/security/advisories/GHSA-q9fq-3rx9-7xcv"}, {"name": "https://github.com/riebl/vanetza/commit/e1a2e2709210d309458c3d77f98d50dec26c0df0", "tags": ["x_refsource_MISC"], "url": "https://github.com/riebl/vanetza/commit/e1a2e2709210d309458c3d77f98d50dec26c0df0"}], "affected": [{"vendor": "riebl", "product": "vanetza", "versions": [{"version": "< e1a2e2709210d309458c3d77f98d50dec26c0df0", "status": "affected"}, {"version": "<= 26.02", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-26T21:18:33.445Z"}, "descriptions": [{"lang": "en", "value": "Vanetza is an open-source implementation of the ETSI C-ITS protocol suite. In 26.02 and earlier, a denial-of-service vulnerability was identified in the cryptographic verification pipeline of Vanetza. When processing incoming V2X messages, the ASN.1 decoder accepts the structure as syntactically valid. However, this reveals a logic-based protocol failure where semantic constraints on specific fields are only strictly enforced during OER re-encoding. Specifically, if a crafted packet contains a certificate where the Psid (Provider Service Identifier) sub-type violates subtype constraints (e.g., out-of-range or invalid CHOICE variant), it is accepted during initial parsing, where subtype constraints are not enforced. Later, when StraightVerifyService attempts to calculate a message hash for cryptographic verification, it must re-encode the signing certificate. The underlying ASN.1 wrapper (asn1c_wrapper.cpp) detects the semantic violation during encoding and raises a std::runtime_error. This exception is not caught within the encoding path and propagates to std::terminate, resulting in immediate process termination. This vulnerability is fixed with commit e1a2e2709210d309458c3d77f98d50dec26c0df0."}], "source": {"advisory": "GHSA-q9fq-3rx9-7xcv", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/riebl/vanetza/security/advisories/GHSA-q9fq-3rx9-7xcv", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-27T13:01:15.575636Z", "id": "CVE-2026-44905", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-27T13:01:57.541Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44905", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-27T13:01:15.575636Z"}}}], "references": [{"url": "https://github.com/riebl/vanetza/security/advisories/GHSA-q9fq-3rx9-7xcv", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-27T13:01:52.093Z"}}], "cna": {"title": "Vanetza: Remote Denial of Service via Uncaught OER Encoding Exception in Cryptographic Verification", "source": {"advisory": "GHSA-q9fq-3rx9-7xcv", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "riebl", "product": "vanetza", "versions": [{"status": "affected", "version": "< e1a2e2709210d309458c3d77f98d50dec26c0df0"}, {"status": "affected", "version": "<= 26.02"}]}], "references": [{"url": "https://github.com/riebl/vanetza/security/advisories/GHSA-q9fq-3rx9-7xcv", "name": "https://github.com/riebl/vanetza/security/advisories/GHSA-q9fq-3rx9-7xcv", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/riebl/vanetza/commit/e1a2e2709210d309458c3d77f98d50dec26c0df0", "name": "https://github.com/riebl/vanetza/commit/e1a2e2709210d309458c3d77f98d50dec26c0df0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Vanetza is an open-source implementation of the ETSI C-ITS protocol suite. In 26.02 and earlier, a denial-of-service vulnerability was identified in the cryptographic verification pipeline of Vanetza. When processing incoming V2X messages, the ASN.1 decoder accepts the structure as syntactically valid. However, this reveals a logic-based protocol failure where semantic constraints on specific fields are only strictly enforced during OER re-encoding. Specifically, if a crafted packet contains a certificate where the Psid (Provider Service Identifier) sub-type violates subtype constraints (e.g., out-of-range or invalid CHOICE variant), it is accepted during initial parsing, where subtype constraints are not enforced. Later, when StraightVerifyService attempts to calculate a message hash for cryptographic verification, it must re-encode the signing certificate. The underlying ASN.1 wrapper (asn1c_wrapper.cpp) detects the semantic violation during encoding and raises a std::runtime_error. This exception is not caught within the encoding path and propagates to std::terminate, resulting in immediate process termination. This vulnerability is fixed with commit e1a2e2709210d309458c3d77f98d50dec26c0df0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-248", "description": "CWE-248: Uncaught Exception"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-26T21:18:33.445Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44905", "state": "PUBLISHED", "dateUpdated": "2026-05-27T13:01:57.541Z", "dateReserved": "2026-05-07T21:50:33.547Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-26T21:18:33.445Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "vanetza", "vendor": "riebl", "versions": [{"status": "affected", "version": "< e1a2e2709210d309458c3d77f98d50dec26c0df0"}, {"status": "affected", "version": "<= 26.02"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Vanetza is an open-source implementation of the ETSI C-ITS protocol suite. In 26.02 and earlier, a denial-of-service vulnerability was identified in the cryptographic verification pipeline of Vanetza. When processing incoming V2X messages, the ASN.1 decoder accepts the structure as syntactically valid. However, this reveals a logic-based protocol failure where semantic constraints on specific fields are only strictly enforced during OER re-encoding. Specifically, if a crafted packet contains a certificate where the Psid (Provider Service Identifier) sub-type violates subtype constraints (e.g., out-of-range or invalid CHOICE variant), it is accepted during initial parsing, where subtype constraints are not enforced. Later, when StraightVerifyService attempts to calculate a message hash for cryptographic verification, it must re-encode the signing certificate. The underlying ASN.1 wrapper (asn1c_wrapper.cpp) detects the semantic violation during encoding and raises a std::runtime_error. This exception is not caught within the encoding path and propagates to std::terminate, resulting in immediate process termination. This vulnerability is fixed with commit e1a2e2709210d309458c3d77f98d50dec26c0df0."}, {"lang": "es", "value": "Vanetza es una implementaci\u00f3n de c\u00f3digo abierto de la suite de protocolos ETSI C-ITS. En la versi\u00f3n 26.02 y anteriores, se identific\u00f3 una vulnerabilidad de denegaci\u00f3n de servicio en la cadena de verificaci\u00f3n criptogr\u00e1fica de Vanetza. Al procesar mensajes V2X entrantes, el decodificador ASN.1 acepta la estructura como sint\u00e1cticamente v\u00e1lida. Sin embargo, esto revela un fallo de protocolo basado en l\u00f3gica donde las restricciones sem\u00e1nticas en campos espec\u00edficos solo se aplican estrictamente durante la recodificaci\u00f3n OER. Espec\u00edficamente, si un paquete manipulado contiene un certificado donde el subtipo Psid (Identificador de Servicio del Proveedor) viola las restricciones de subtipo (por ejemplo, fuera de rango o variante CHOICE inv\u00e1lida), es aceptado durante el an\u00e1lisis inicial, donde las restricciones de subtipo no se aplican. M\u00e1s tarde, cuando StraightVerifyService intenta calcular un hash de mensaje para verificaci\u00f3n criptogr\u00e1fica, debe recodificar el certificado de firma. El envoltorio ASN.1 subyacente (asn1c_wrapper.cpp) detecta la violaci\u00f3n sem\u00e1ntica durante la codificaci\u00f3n y lanza un std::runtime_error. Esta excepci\u00f3n no es capturada dentro de la ruta de codificaci\u00f3n y se propaga a std::terminate, lo que resulta en la terminaci\u00f3n inmediata del proceso. Esta vulnerabilidad se corrige con el commit e1a2e2709210d309458c3d77f98d50dec26c0df0."}], "id": "CVE-2026-44905", "lastModified": "2026-07-24T12:10:00.210", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44905", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-27T13:01:15.575636Z", "version": "2.0.3"}}]}, "published": "2026-05-26T22:16:43.150", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/riebl/vanetza/commit/e1a2e2709210d309458c3d77f98d50dec26c0df0"}, {"source": "security-advisories@github.com", "url": "https://github.com/riebl/vanetza/security/advisories/GHSA-q9fq-3rx9-7xcv"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/riebl/vanetza/security/advisories/GHSA-q9fq-3rx9-7xcv"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-248"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "< e1a2e2709210d309458c3d77f98d50dec26c0df0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "<= 26.02"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "vanetza", "source": "cna", "vendor": "riebl"}, "product": "vanetza", "vendor": "riebl"}], "created": "2026-05-26T22:30:17.920681+00:00", "updated": "2026-05-26T22:30:18.408851+00:00", "vendors": ["riebl", "riebl$PRODUCT$vanetza"]}