CVE-2026-37554

An issue was discovered in Vanetza V2X v26.02 allowing remote unauthorized attackers to cause a denial of service. The vulnerability exists in the GeoNetworking packet processing pipeline where OpenSSL exceptions from ECC point validation (invalid compressed point, point not on curve) are not properly caught by the Router::indicate() call chain. The openssl_wrapper.cpp check() function (line 19) throws openssl::Exception when OpenSSL operations fail. The parser's catch block in parse_secured() should catch these, but the exception escapes through subsequent processing stages (indicate_common, indicate_extended). This causes std::terminate, crashing the V2X receiver.

• CWE-248

• https://gist.github.com/sgInnora/45128ae15d52df7238680a8f2da8359f
• https://github.com/riebl/vanetza
• https://github.com/riebl/vanetza/blob/master/vanetza/geonet/router.cpp
• https://github.com/riebl/vanetza/blob/master/vanetza/security/openssl_wrapper.cpp
• https://github.com/riebl/vanetza/security/advisories/GHSA-44qj-vh8c-5354

Published

May 1, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-37539Buffer overflow vulnerability in cannelloni v2.0.0 in CAN fr…9.8
• CVE-2026-3754A vulnerability was found in SourceCodester Sales and Invent…8.8
• CVE-2026-37540OpenAMP v2025.10.0 ELF loader contains an integer overflow v…9.8
• CVE-2026-37541Buffer overflow vulnerability in Open Vehicle Monitoring Sys…10
• CVE-2026-3755A vulnerability was determined in SourceCodester Sales and I…8.8
• CVE-2026-37552Unsafe deserialization vulnerability in MixPHP Framework 2.x…8.4
• CVE-2026-37555An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec.…7.5
• CVE-2026-3756A vulnerability was identified in SourceCodester Sales and I…8.8
• CVE-2026-3757A security flaw has been discovered in projectworlds Online …9.8
• CVE-2026-37579An issue in SMSGate sms-core<=2.1.13.6 allows a remote attac…7.3
• CVE-2026-3758A weakness has been identified in projectworlds Online Art G…9.8
• CVE-2026-37589SourceCodester Storage Unit Rental Management System v1.0 is…2.7