CVE-2026-71646: RACER Robotics Denial of Service Vulnerability

CVE-2026-71646 Overview

CVE-2026-71646 is a denial-of-service vulnerability in the Robotics-STAR-Lab (SYSU STAR Group) RACER swarm exploration framework. The flaw resides in the FastExplorationFSM::optTimerCallback() function inside swarm_exploration/exploration_manager/src/fast_exploration_fsm.cpp. An attacker can trigger uncontrolled resource consumption [CWE-400] over the network, causing the exploration finite state machine to become unresponsive. The tested version is identified by commit abcdef1234567890.

Critical Impact
A remote, unauthenticated attacker can disrupt the availability of robotic swarm exploration nodes running RACER, halting autonomous navigation and coordination logic.

Affected Products

Robotics-STAR-Lab RACER (SYSU STAR Group)
RACER swarm_exploration/exploration_manager component
RACER commit abcdef1234567890

Discovery Timeline

2026-09-11 - CVE-2026-71646 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-71646

Vulnerability Analysis

RACER is an open-source rapid exploration framework used for coordinating multi-robot autonomous exploration. The vulnerability affects the timer callback FastExplorationFSM::optTimerCallback(), which participates in the finite state machine driving exploration decisions. Malformed or unexpected input processed by this callback triggers uncontrolled resource consumption, degrading or halting node execution.

Because RACER runs on top of ROS-style messaging, the callback is reachable through network-facing topics. An attacker able to publish to the relevant topic can force the exploration node into a denial-of-service condition without authentication or user interaction. See the GitHub Issue Discussion for the maintainer thread.

Root Cause

The root cause is classified under [CWE-400] Uncontrolled Resource Consumption. The optTimerCallback() function lacks sufficient validation of the state it processes on each timer tick. Under attacker-controlled conditions, the callback consumes resources without bound, blocking the FSM from progressing.

Attack Vector

The attack vector is network-based with low complexity and no privileges required. An attacker with reachability to the ROS transport layer of the target node sends crafted messages that reach the optimization timer callback. Refer to the GitHub Gist PoC Code for a proof-of-concept demonstrating the trigger. No verified sanitized exploitation code is republished here; consult the linked references for technical detail.

Detection Methods for CVE-2026-71646

Indicators of Compromise

Unexpected CPU saturation or hangs in the exploration_manager process on robots running RACER.
Exploration FSM stuck in an optimization state with no progress in log output from fast_exploration_fsm.cpp.
Inbound ROS topic traffic from unknown or unauthorized publishers on the swarm exploration network segment.

Detection Strategies

Monitor process-level resource usage of RACER exploration nodes and alert on sustained CPU or memory pressure.
Inspect ROS topic publishers using rostopic info and correlate against an allowlist of expected swarm members.
Enable verbose logging in the FSM to record entry and exit of optTimerCallback() and detect callback stalls.

Monitoring Recommendations

Capture network traffic on ROS master and DDS discovery ports to identify anomalous message flows.
Track FSM state transitions over time and alert when the optimization state persists beyond expected thresholds.
Aggregate telemetry from all swarm nodes into a central data lake to correlate simultaneous availability drops.

How to Mitigate CVE-2026-71646

Immediate Actions Required

Isolate RACER-based robots from untrusted networks and restrict ROS transport to authenticated peers.
Disable or firewall the affected exploration topics if operational use does not require external publishers.
Review the upstream GitHub Issue Discussion for maintainer guidance.

Patch Information

No vendor patch is listed in the NVD entry at the time of publication. Users of RACER commit abcdef1234567890 should track the upstream repository for a fix addressing FastExplorationFSM::optTimerCallback() and rebuild from a corrected commit once available.

Workarounds

Deploy RACER nodes on segmented networks reachable only by trusted swarm members.
Enforce ROS 2 DDS security profiles or SROS authentication where the deployment supports it.
Add a supervisory watchdog that restarts the exploration_manager process when the FSM stalls in the optimization state.
Rate-limit inbound messages on the affected topic at the network layer to reduce exploitability.

bash

# Example: restrict ROS traffic to trusted swarm subnet using iptables
iptables -A INPUT -p tcp --dport 11311 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 11311 -j DROP
iptables -A INPUT -p udp --dport 7400:7500 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p udp --dport 7400:7500 -j DROP