TI-2026-32031 Aliases CVE-2026-43988

Vanetza: Remote Denial of Service via Uncaught Exception in ASN.1/OER Parsing

LOW 38CWE-248Published 2026-05-26 · Updated 2026-05-27

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-248.

Summary

Vanetza is an open-source implementation of the ETSI C-ITS protocol suite. In 26.02 and earlier, a denial-of-service vulnerability was identified in the ASN.1/OER parsing pipeline of Vanetza. When processing malformed network packets containing corrupted ASN.1/OER structures (e.g., invalid length fields or malformed certificate encoding), the ASN.1 wrapper (asn1c_wrapper.cpp) raises a std::runtime_error. This exception is not caught at the parsing boundary and propagates to std::terminate, resulting in process termination. This vulnerability is fixed with commit 62dfe58a8342512b6e1947d75821402ada524f1a.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00184 7th percentileScored 2026-11-07

Fix Fixed vanetza (riebl): 62dfe58a8342512b6e1947d75821402ada524f1a

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
riebl	vanetza	before 62dfe58a8342512b6e1947d75821402ada524f1a; up to 26.02	62dfe58a8342512b6e1947d75821402ada524f1a	Patch available	CNA

vanetza Vendorriebl Affected before 62dfe58a8342512b6e1947d75821402ada524f1a; up to 26.02 Fixed in 62dfe58a8342512b6e1947d75821402ada524f1a Patch available CNA

Remediation

Fix · CNA vanetza (riebl) Fixed in 62dfe58a8342512b6e1947d75821402ada524f1a

Timeline

2026-10-02 Threatist record created from CVE-2026-43988

References

Other 2

TI-2026-32779 Vanetza: Remote Denial of Service via Uncaught OER Encoding Exception in Cryptographic Verification CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences