CVE-2026-37554: Vanetza V2X DoS Vulnerability

CVE-2026-37554 Overview

CVE-2026-37554 is a denial of service vulnerability in Vanetza V2X v26.02, an open-source implementation of ETSI ITS-G5 vehicle-to-everything (V2X) communication protocols. The flaw resides in the GeoNetworking packet processing pipeline, where OpenSSL exceptions raised during elliptic curve cryptography (ECC) point validation are not caught by the Router::indicate() call chain. A remote, unauthenticated attacker can transmit a crafted secured GeoNetworking packet to trigger std::terminate, crashing the V2X receiver process.

Critical Impact

A single malformed V2X packet can crash the receiver, disrupting safety-critical vehicle-to-everything communications without authentication or user interaction.

Affected Products

• Vanetza V2X v26.02
• Vanetza GeoNetworking router component (router.cpp)
• Vanetza security OpenSSL wrapper (openssl_wrapper.cpp)

Discovery Timeline

• 2026-05-01 - CVE-2026-37554 published to NVD
• 2026-05-07 - Last updated in NVD database

Technical Details for CVE-2026-37554

Vulnerability Analysis

The vulnerability is classified as an uncaught exception flaw [CWE-248] in the Vanetza V2X stack. The check() function in openssl_wrapper.cpp at line 19 throws openssl::Exception whenever an OpenSSL primitive returns an error. During processing of a secured GeoNetworking packet, ECC point decoding can fail with conditions such as invalid compressed point or point not on curve. While the parser includes a catch block within parse_secured(), the exception propagates beyond the parser through downstream processing stages including indicate_common() and indicate_extended(). Because no enclosing handler exists in the Router::indicate() call chain, the C++ runtime invokes std::terminate, immediately ending the receiver process. The result is a deterministic crash of the V2X stack on receipt of a single malformed packet.

Root Cause

The root cause is incomplete exception handling boundaries in the secured packet processing pipeline. The parse_secured() parser anticipates parsing errors but not exceptions thrown deeper in the cryptographic verification path. When OpenSSL ECC validation fails after the parser returns, the exception travels up the call stack through frames that lack matching catch blocks for openssl::Exception.

Attack Vector

An attacker on the same V2X network or radio range crafts a secured GeoNetworking packet whose signer certificate or signature contains a malformed ECC public key. Examples include points that are not on the configured curve or invalid compressed point encodings. When the targeted Vanetza node receives and processes the packet, OpenSSL throws an exception during point validation, the unhandled exception escapes the router pipeline, and the receiver terminates. No authentication, prior session, or user interaction is required.

A fully working code example is not provided in the public advisory. See the GitHub Security Advisory GHSA-44qj-vh8c-5354 and the affected files router.cpp and openssl_wrapper.cpp for technical details.

Detection Methods for CVE-2026-37554

Indicators of Compromise

• Unexpected termination of the Vanetza receiver process with std::terminate or abort() recorded in system logs.
• Core dumps referencing openssl::Exception, parse_secured, indicate_common, or indicate_extended frames.
• Repeated V2X service restarts correlated with inbound GeoNetworking traffic from a specific source identifier.

Detection Strategies

• Monitor process supervisors such as systemd for repeated restarts of Vanetza or applications linking the library.
• Capture and inspect inbound GeoNetworking frames for malformed ECC public keys or signature points using a V2X protocol analyzer.
• Correlate crash timestamps with received Cooperative Awareness Messages (CAM) or Decentralized Environmental Notification Messages (DENM) to identify the triggering source.

Monitoring Recommendations

• Enable verbose logging in the Vanetza security subsystem to record OpenSSL validation failures before termination.
• Forward crash telemetry and core dump metadata to a centralized logging or SIEM platform for correlation across V2X fleet nodes.
• Track per-source-address rates of secured packets that fail signature or certificate validation as an early warning signal.

How to Mitigate CVE-2026-37554

Immediate Actions Required

• Audit deployed Vanetza builds and identify any nodes running v26.02 or earlier commits lacking the exception handling fix.
• Apply upstream patches from the Vanetza repository once available, or backport catch (const openssl::Exception&) handlers into the Router::indicate() call chain.
• Restrict V2X interfaces to trusted radio environments during testing and validation phases until the patch is deployed.

Patch Information

Refer to the GitHub Security Advisory GHSA-44qj-vh8c-5354 for the authoritative fix and affected commits. The remediation requires wrapping the secured packet processing path so that openssl::Exception thrown by check() in openssl_wrapper.cpp is caught and converted into a packet-drop result rather than propagating to std::terminate.

Workarounds

• Run Vanetza under a process supervisor configured to automatically restart the receiver after termination to limit downtime.
• Deploy upstream filters or rate limits on inbound secured GeoNetworking packets from unverified senders.
• Disable secured packet processing in non-production environments where signature verification is not required.

# Example systemd unit hardening to auto-recover the V2X receiver
[Service]
ExecStart=/usr/local/bin/vanetza-receiver
Restart=always
RestartSec=2s
StartLimitIntervalSec=60
StartLimitBurst=10