CVE-2026-91141

A critical memory exhaustion vulnerability (CVE-2026-91141) in COVESA vsomeip (SOME/IP implementation) allows a remote, unauthenticated attacker to crash ECUs or entire vehicle networks. The flaw affects all versions up to 3.7.3 and was silently fixed in the 3.7.4 release.

Technical Breakdown - Root Cause: The reliable (TCP) endpoint allocates a receive buffer based on the 32-bit length field in the SOME/IP header before validating that the declared bytes have actually been received. - Attack Vector: An unauthenticated peer sends a crafted SOME/IP message declaring a payload size of up to ~4 GB. The receiver immediately allocates that memory. - Impact: Host memory exhaustion leading to denial of service (DoS) on the target ECU or gateway. - Affected: vsomeip <= 3.7.3. Fixed in 3.7.4 (2026-07-06). - Public Reference: COVESA/vsomeip issue #1009.

Defense Patch to vsomeip 3.7.4 immediately. If patching is delayed, implement network-level ACLs to restrict which peers can establish TCP connections to vsomeip endpoints, and consider applying resource limits (e.g., ulimit ) on the vsomeip process as a temporary mitigation.

Source: https://kb.cert.org/vuls/id/128947