PT-2026-43425 · Vanetza · Vanetza

Tw89Coder · Published 2026-05-26 · Updated 2026-05-27 · CVE-2026-44905

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Vanetza versions 26.02 and earlier

Description A denial-of-service issue exists in the cryptographic verification pipeline. When processing incoming V2X messages, the ASN.1 decoder accepts structures as syntactically valid even if semantic constraints on specific fields are violated. If a crafted packet contains a certificate where the Psid (Provider Service Identifier) sub-type is out-of-range or uses an invalid CHOICE variant, it is accepted during initial parsing. Subsequently, when the StraightVerifyService function attempts to calculate a message hash for cryptographic verification, it re-encodes the signing certificate. The ASN.1 wrapper asn1c wrapper.cpp detects the semantic violation during this encoding process and raises a std::runtime error. Because this exception is not caught, it propagates to std::terminate, causing the process to terminate immediately.

Recommendations Update to the version containing commit e1a2e2709210d309458c3d77f98d50dec26c0df0.

Exploit

Fix

DoS

Weakness Enumeration

CWE-248

Related Identifiers

CVE-2026-44905

Affected Products

Vanetza

References · 4

• 🔥 https://github.com/riebl/vanetza/security/advisories/GHSA-q9fq-3rx9-7xcv · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-44905 · Security Note
• https://github.com/riebl/vanetza/commit/e1a2e2709210d309458c3d77f98d50dec26c0df0 · Note
• https://t.me/CVEtracker/55033 · Telegram Post