CVE-2026-71641: EGO-Planner-v2 Denial of Service Vulnerability

CVE-2026-71641 Overview

CVE-2026-71641 is a denial of service vulnerability in ZJU-FAST-Lab EGO-Planner-v2, an open-source quadrotor trajectory planning framework. The flaw affects all versions up to commit 5c99a95880401e2599638d567abc0e240396cb42. The vulnerability arises from the interaction between the traj_server node, the poscmd_2_odom component, and the EGOReplanFSM emergency recovery logic. An attacker can trigger uncontrolled resource consumption [CWE-400], rendering the planner unavailable. The issue is tracked as an availability-impacting flaw with a network attack vector.

Critical Impact
A remote attacker can disrupt trajectory planning in autonomous drones running EGO-Planner-v2, causing loss of vehicle control availability without requiring authentication or user interaction.

Affected Products

ZJU-FAST-Lab EGO-Planner-v2 (all versions up to commit 5c99a95880401e2599638d567abc0e240396cb42)
traj_server node
poscmd_2_odom and EGOReplanFSM components

Discovery Timeline

2026-09-11 - CVE-2026-71641 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-71641

Vulnerability Analysis

EGO-Planner-v2 is a gradient-based trajectory planner used in autonomous quadrotor navigation research and deployments. The vulnerability lives in the runtime interaction between three components. The traj_server publishes position commands, poscmd_2_odom simulates odometry feedback from those commands, and EGOReplanFSM orchestrates state transitions including emergency recovery. When these components exchange inconsistent state, the finite state machine enters a recovery path that consumes resources without bound, categorized under uncontrolled resource consumption [CWE-400].

Because the affected nodes communicate over ROS topics that may be reachable across a network, a remote actor able to publish crafted messages can drive the planner into the fault path. The result is a denial of service in the planning pipeline, which for an airborne platform translates to loss of controlled flight.

Root Cause

The root cause is insufficient validation and coordination between traj_server, poscmd_2_odom, and the emergency recovery branch of EGOReplanFSM. Crafted or malformed inputs push the state machine into a recovery loop that does not terminate, exhausting compute or messaging resources. Reference the GitHub issue discussion for reproduction context.

Attack Vector

The attack vector is network-based with no privileges or user interaction required. An attacker with reachability to the ROS message bus used by the planner can publish messages that trigger the vulnerable code path. See the published GitHub Gist proof of concept and the EGO-Planner-v2 repository for component details.

No verified code examples are available. The vulnerability is described in prose based on the referenced advisory materials.

Detection Methods for CVE-2026-71641

Indicators of Compromise

Repeated entry into the EGOReplanFSM emergency recovery state without normal transitions back to planning.
Sustained high CPU utilization on the host running the traj_server and planner nodes.
Abnormal message rates or malformed messages on ROS topics consumed by poscmd_2_odom or traj_server.

Detection Strategies

Monitor ROS node logs for repeated EGOReplanFSM state transitions consistent with recovery loops.
Baseline message throughput on planner-related topics and alert on statistical deviations.
Correlate planner unresponsiveness with unauthenticated publishers appearing on the ROS master.

Monitoring Recommendations

Instrument ROS nodes with health checks that report state machine transitions to a central logging system.
Capture packet flows on interfaces exposing ROS topics for retrospective analysis.
Alert on unexpected publishers subscribing to or writing to trajectory-related topics.

How to Mitigate CVE-2026-71641

Immediate Actions Required

Restrict network reachability to the ROS master and planner nodes to trusted hosts only.
Disable or firewall inbound access to trajectory-related topics from untrusted networks.
Monitor the upstream repository and issue #63 for patch availability.

Patch Information

As of the last NVD update on 2026-09-15, no vendor patch has been published for commits at or before 5c99a95880401e2599638d567abc0e240396cb42. Track the upstream repository for fixes to the interaction between traj_server, poscmd_2_odom, and EGOReplanFSM.

Workarounds

Deploy the planner on an isolated network segment with strict ingress controls.
Add input validation wrappers to filter malformed messages before they reach poscmd_2_odom or traj_server.
Implement watchdog logic that resets the planner if EGOReplanFSM remains in emergency recovery beyond a defined threshold.
Use a ROS 2 deployment with SROS2 authentication where feasible to prevent unauthorized publishers.

bash

# Configuration example: restrict ROS master access with host firewall
sudo iptables -A INPUT -p tcp --dport 11311 -s 10.0.0.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 11311 -j DROP