Denial-of-Service Vulnerability in Vanetza Open-Source Implementation

CVE-2026-44905

What is CVE-2026-44905?

A denial-of-service vulnerability has been identified in the Vanetza open-source implementation of the ETSI C-ITS protocol suite. This flaw resides within the cryptographic verification process when handling V2X messages. Specifically, the ASN.1 decoder incorrectly accepts packets with sub-optimal parameters, which leads to a logic flaw in protocol enforcement. Although the initial parsing phase lacks strict checks on specific fields, it later fails when attempting to re-encode a signing certificate with invalid identifiers. This oversight results in an uncaught runtime error that causes the process to terminate abruptly when the service tries to calculate a message hash for verification. The issue has been addressed in a subsequent commit.

References