PT-2026-36501 · Unknown · Vanetza V2X

Sginnora · Published 2026-05-01 · Updated 2026-05-05 · CVE-2026-37554

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Vanetza V2X version 26.02

Description A flaw in the GeoNetworking packet processing pipeline allows remote unauthorized attackers to cause a denial of service. The issue occurs because OpenSSL exceptions resulting from ECC point validation (such as an invalid compressed point or a point not on the curve) are not properly handled by the Router::indicate() call chain. Specifically, the check() function in openssl wrapper.cpp throws an openssl::Exception upon failure. While the parse secured() function contains a catch block, the exception escapes through the indicate common and indicate extended processing stages, leading to std::terminate and crashing the V2X receiver.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-248

Related Identifiers

CVE-2026-37554

Affected Products

Vanetza V2X

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-37554 · Security Note
• https://github.com/riebl/vanetza/blob/master/vanetza/security/openssl_wrapper.cpp · Note
• https://github.com/riebl/vanetza/security/advisories/GHSA-44qj-vh8c-5354 · Note
• https://github.com/riebl/vanetza/blob/master/vanetza/geonet/router.cpp · Note
• https://github.com/riebl/vanetza · Note
• https://gist.github.com/sgInnora/45128ae15d52df7238680a8f2da8359f · Note
• https://twitter.com/infoflowcloud/status/2050255569022279827 · Twitter Post
• https://twitter.com/CVEnew/status/2050254041230319817 · Twitter Post
• https://t.me/cveNotify/162253 · Telegram Post