PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-44905 riebl CVE debrief

A denial-of-service vulnerability exists in Vanetza versions 26.02 and earlier, affecting the cryptographic verification pipeline for V2X (Vehicle-to-Everything) messages. The flaw stems from inconsistent enforcement of ASN.1 semantic constraints: malformed certificates with invalid Psid (Provider Service Identifier) subtypes are accepted during initial parsing but trigger an unhandled std::runtime_error during OER re-encoding when StraightVerifyService calculates message hashes. This exception propagates to std::terminate, causing immediate process termination. The vulnerability is remotely exploitable without authentication, as attackers can craft malicious V2X messages to crash Vanetza-based C-ITS (Cooperative Intelligent Transport Systems) implementations. The fix in commit e1a2e2709210d309458c3d77f98d50dec26c0df0 addresses the constraint validation gap.

Vendor
riebl
Product
vanetza
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-26
Original CVE updated
2026-07-23
Advisory published
2026-05-26
Advisory updated
2026-07-23

Who should care

Operators of C-ITS/V2X infrastructure using Vanetza; automotive security teams deploying ETSI-compliant connected vehicle systems; critical transportation infrastructure defenders; ASN.1 protocol implementers

Technical summary

The vulnerability resides in Vanetza's StraightVerifyService cryptographic verification flow. During V2X message processing, the ASN.1 decoder (asn1c_wrapper.cpp) accepts syntactically valid certificates with semantically invalid Psid subtypes—specifically out-of-range values or invalid CHOICE variants—because subtype constraints are not enforced during initial parsing. When StraightVerifyService subsequently re-encodes the signing certificate for hash calculation, the OER encoder detects the semantic violation and raises std::runtime_error. This exception is uncaught in the encoding path, propagating to std::terminate and causing process crash. The attack vector is network-based, requires no authentication, and results in complete availability loss (CVSS 3.1: 7.5 HIGH).

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade Vanetza to version containing commit e1a2e2709210d309458c3d77f98d50dec26c0df0 or later
  • Apply vendor security advisory patches when available
  • Implement network segmentation to restrict untrusted V2X message sources where feasible
  • Monitor for unexpected Vanetza process terminations as potential exploitation indicators
  • Review exception handling in ASN.1 encoding paths for similar constraint validation gaps

Evidence notes

Vulnerability description confirms Vanetza 26.02 and earlier affected; commit e1a2e2709210d309458c3d77f98d50dec26c0df0 identified as fix; CVSS 7.5 (HIGH) with AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector indicates network-reachable, unauthenticated denial-of-service; CWE-248 (Uncaught Exception) classified as weakness type.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-44905 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-44905

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-44905 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-44905

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.