Vanetza Remote DoS via Uncaught Exception in ECC Verification (CVE-2026-37554)

Vulnerability Summary: Vanetza Remote Denial of Service Vulnerability Vulnerability Overview Vulnerability Name: Remote Denial of Service via Uncaught Exception in ECC Verification CVE ID: CVE-2026-37554 Vulnerability Type: CWE-248: Uncaught Exception Severity: High (7.5/10) Description: A denial of service vulnerability was discovered in Vanetza's cryptographic verification pipeline. When processing GeoNetworking security messages containing invalid elliptic curve public keys (e.g., malformed compressed points), the OpenSSL backend detects the invalid key and throws a . However, the upstream verification logic fails to catch this exception, allowing it to propagate to , which causes the application to abort. Impact Scope Affected Versions: 24.10, 25.06, 26.02 Impact: An unauthenticated remote attacker can send crafted network packets to trigger an exception and terminate the process, resulting in a reliable Denial of Service (DoS) and service unavailability. Attack Vector: Network (Network) CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Remediation Fixed Commit: 483e72ca68a51990f0690858769740b8e0b1eede Recommended Fix: Introduce exception handling around verification boundaries (e.g., within or higher-level entry points) to safely reject malformed inputs without terminating the process. Reproduction and Exploit Code (POC) Test Environment: Target Repository: https://github.com/riebl/vanetza Tested Commit Hash: 548f77ec78d6000e7d8400d44162e584000a0ba9 Compiler/Sanitizer: Compiled with AddressSanitizer (ASAN) enabled. Reproduction Steps: 1. Checkout the specified commit and build Vanetza using a fuzzing tool (enable the target). 2. Feed the minimal PoC input into the harness. Execution Commands: Observed Behavior: When inputting : When inputting :

Goal Reached Thanks to every supporter — we hit 100%!

Vanetza Remote DoS via Uncaught Exception in ECC Verification (CVE-2026-37554)

More from this source