PatchSiren cyber security CVE debrief
CVE-2026-44905 riebl CVE debrief
A denial-of-service vulnerability exists in Vanetza versions 26.02 and earlier, affecting the cryptographic verification pipeline for V2X (Vehicle-to-Everything) messages. The flaw stems from inconsistent enforcement of ASN.1 semantic constraints: malformed certificates with invalid Psid (Provider Service Identifier) subtypes are accepted during initial parsing but trigger an unhandled std::runtime_error during OER re-encoding when StraightVerifyService calculates message hashes. This exception propagates to std::terminate, causing immediate process termination. The vulnerability is remotely exploitable without authentication, as attackers can craft malicious V2X messages to crash Vanetza-based C-ITS (Cooperative Intelligent Transport Systems) implementations. The fix in commit e1a2e2709210d309458c3d77f98d50dec26c0df0 addresses the constraint validation gap.
- Vendor
- riebl
- Product
- vanetza
- CVSS
- HIGH 7.5
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-26
- Original CVE updated
- 2026-05-27
- Advisory published
- 2026-05-26
- Advisory updated
- 2026-05-27
Who should care
Operators of C-ITS/V2X infrastructure using Vanetza; automotive security teams deploying ETSI-compliant connected vehicle systems; critical transportation infrastructure defenders; ASN.1 protocol implementers
Technical summary
The vulnerability resides in Vanetza's StraightVerifyService cryptographic verification flow. During V2X message processing, the ASN.1 decoder (asn1c_wrapper.cpp) accepts syntactically valid certificates with semantically invalid Psid subtypes—specifically out-of-range values or invalid CHOICE variants—because subtype constraints are not enforced during initial parsing. When StraightVerifyService subsequently re-encodes the signing certificate for hash calculation, the OER encoder detects the semantic violation and raises std::runtime_error. This exception is uncaught in the encoding path, propagating to std::terminate and causing process crash. The attack vector is network-based, requires no authentication, and results in complete availability loss (CVSS 3.1: 7.5 HIGH).
Defensive priority
HIGH
Recommended defensive actions
- Upgrade Vanetza to version containing commit e1a2e2709210d309458c3d77f98d50dec26c0df0 or later
- Apply vendor security advisory patches when available
- Implement network segmentation to restrict untrusted V2X message sources where feasible
- Monitor for unexpected Vanetza process terminations as potential exploitation indicators
- Review exception handling in ASN.1 encoding paths for similar constraint validation gaps
Evidence notes
Vulnerability description confirms Vanetza 26.02 and earlier affected; commit e1a2e2709210d309458c3d77f98d50dec26c0df0 identified as fix; CVSS 7.5 (HIGH) with AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector indicates network-reachable, unauthenticated denial-of-service; CWE-248 (Uncaught Exception) classified as weakness type.
Official resources
2026-05-26