CVE-2026-43988: Vanetza ETSI C-ITS DoS Vulnerability

CVE-2026-43988 Overview

CVE-2026-43988 is a denial-of-service vulnerability in Vanetza, an open-source implementation of the ETSI Cooperative Intelligent Transport Systems (C-ITS) protocol suite. The flaw resides in the ASN.1/Octet Encoding Rules (OER) parsing pipeline. When Vanetza processes malformed network packets containing corrupted ASN.1/OER structures, the asn1c_wrapper.cpp component raises a std::runtime_error. The exception is not caught at the parsing boundary and propagates to std::terminate, terminating the process. The issue affects Vanetza versions 26.02 and earlier and is classified under [CWE-248] Uncaught Exception.

Critical Impact

Remote unauthenticated attackers can crash Vanetza processes by sending crafted V2X packets with invalid length fields or malformed certificate encoding, disrupting C-ITS communications.

Affected Products

• Vanetza 26.02
• Vanetza versions prior to 26.02
• Deployments embedding the asn1c_wrapper.cpp parsing component

Discovery Timeline

• 2026-05-26 - CVE-2026-43988 published to NVD
• 2026-05-27 - Last updated in NVD database
• Fix commit - 62dfe58a8342512b6e1947d75821402ada524f1a published in the Vanetza repository

Technical Details for CVE-2026-43988

Vulnerability Analysis

Vanetza decodes incoming V2X messages using ASN.1/OER, a binary encoding format used by ETSI C-ITS protocols. The asn1c_wrapper.cpp parser throws std::runtime_error when it encounters invalid length fields, malformed certificate encoding, or otherwise corrupted ASN.1 structures. The caller does not wrap parsing calls in a try/catch block at the network boundary. As a result, the exception unwinds the stack, reaches the default terminate handler, and aborts the process.

The vulnerability is reachable over the network, requires no authentication, and needs no user interaction. Exploitation does not lead to code execution or data exposure, but service availability is fully impacted because the parsing process exits each time a malformed packet is processed.

Root Cause

The root cause is an uncaught C++ exception ([CWE-248]) at the boundary between untrusted network input and the ASN.1 decoder. Defensive exception handling around asn1::EtsiTs103097Certificate construction and other ASN.1 decoding paths was missing. Any attacker capable of delivering crafted ASN.1/OER bytes to the parser triggers process termination.

Attack Vector

An attacker sends a malformed C-ITS message, such as a corrupted certificate or an ASN.1 structure with an invalid length field, to a Vanetza-based receiver. The parser invokes canonicalize on the malformed certificate, which raises std::runtime_error. With no enclosing handler, std::terminate is invoked and the Vanetza service exits.

     return m_cert ? v3::canonicalize(*m_cert) : boost::none;
 }
 
-boost::optional<Certificate> canonicalize(const asn1::EtsiTs103097Certificate& cert)
+static boost::optional<Certificate> canonicalize(Certificate&& canonical)
 {
-    Certificate canonical { cert };
     bool success = true;
 
     if (canonical->toBeSigned.verifyKeyIndicator.present == Vanetza_Security_VerificationKeyIndicator_PR_verificationKey) {

Source: GitHub Commit 62dfe58

The patch refactors canonicalize to accept a Certificate&& already constructed by the caller. This moves the throwing construction outside the function, allowing callers to handle failure without propagating an exception to std::terminate.

Detection Methods for CVE-2026-43988

Indicators of Compromise

• Unexpected termination of Vanetza processes correlated with inbound V2X traffic
• Core dumps or crash logs referencing asn1c_wrapper.cpp or std::terminate
• Repeated restarts of C-ITS receiver services by supervisors such as systemd

Detection Strategies

• Monitor process exit codes and crash signals on hosts running Vanetza-based services
• Inspect network captures for malformed ETSI ITS messages with invalid ASN.1/OER length fields or truncated EtsiTs103097Certificate structures
• Correlate parser crashes with source IP, RSU identifier, or OBU identifier to identify the originating peer

Monitoring Recommendations

• Enable verbose logging on Vanetza parsing routines and forward logs to a centralized SIEM
• Alert on a rising rate of std::terminate events or service restarts from Vanetza units
• Track packet decode error counters and set thresholds for sustained anomalies

How to Mitigate CVE-2026-43988

Immediate Actions Required

• Upgrade Vanetza to a build that includes commit 62dfe58a8342512b6e1947d75821402ada524f1a
• Restrict V2X message ingress to trusted peers where the deployment topology permits
• Add supervisor-level restart policies with rate limits to prevent crash-loop denial of service

Patch Information

The issue is fixed by commit 62dfe58a8342512b6e1947d75821402ada524f1a in the Vanetza repository. Details are documented in the GitHub Security Advisory GHSA-j6cj-rp87-mfrx and the upstream commit. Rebuild and redeploy any product embedding Vanetza after applying the fix.

Workarounds

• Wrap calls into the ASN.1/OER decoder with try/catch (const std::runtime_error&) blocks at the network boundary and drop offending packets
• Run Vanetza under a process supervisor configured to restart on abnormal exit while applying back-off limits
• Filter inbound C-ITS traffic at the network edge to drop packets that fail basic ASN.1/OER sanity checks

# systemd unit hardening example to contain crash-loop DoS
[Service]
Restart=on-failure
RestartSec=5s
StartLimitIntervalSec=60
StartLimitBurst=5