CVE-2026-71641 ZJU-FAST-Lab CVE debrief

Who should care

Defenders responsible for ZJU-FAST-Lab EGO-Planner-v2 deployments should assess exposure and prioritize verification to mitigate potential denial-of-service risks. This includes verifying affected versions, assessing exposure, and implementing compensating controls. Additionally, defenders should review compensating controls for exposed systems while remediation is scheduled and verified, and track exceptions, retest remediated assets, and close the item.

Why it matters

CVE-2026-71641 is a high-severity vulnerability affecting ZJU-FAST-Lab's EGO-Planner-v2, potentially allowing denial of service. Defenders should assess exposure, prioritize verification, and consider compensating controls.

• Denial of service via interaction between traj_server, poscmd_2_odom, and EGOReplanFSM emergency recovery logic
• Potential disruption to critical systems or services
• Need for verification of affected versions and exposure
• Prioritization of compensating controls and monitoring

Technical summary

An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an attacker to cause a denial of service via interaction between traj_server, poscmd_2_odom, and the EGOReplanFSM emergency recovery logic. The vulnerability affects EGO-Planner-v2 deployments, and defenders should prioritize verifying affected versions, assessing exposure, and implementing compensating controls to mitigate potential denial-of-service risks. The vulnerability has been described as a high-severity issue, with a CVSS score of 7.5.

Defensive priority

Defenders should prioritize verifying affected versions, assessing exposure, and implementing compensating controls to mitigate potential denial-of-service risks.

Recommended defensive actions

• Verify if EGO-Planner-v2 versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 are in use
• Assess exposure to potential denial-of-service risks
• Implement compensating controls to mitigate potential impacts
• Monitor for official vendor remediation or updates
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD detail explicitly state that the vulnerability affects ZJU-FAST-Lab EGO-Planner-v2. Multiple source references corroborate this vendor-product pair. The vulnerability has been described as a denial of service via interaction between traj_server, poscmd_2_odom, and the EGOReplanFSM emergency recovery logic. Defenders should verify if EGO-Planner-v2 versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 are in use and assess exposure to potential denial-of-service risks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.