CVE-2026-91141
validatingZero is analyzing and reversing it now.description
COVESA vSomeIp in its default configuration can allocate excessive memory when processing a TCP message with an attacker-controlled SOME/IP length. A remote unauthenticated attacker may cause service termination or exhaust host memory. Exploitation requires network access to a reachable vSomeIp TCP endpoint.
Still under analysis: more detail becomes available as the pipeline runs.
mitigation
Restrict network access to vSomeIp TCP endpoints to trusted peers and apply connection-level filtering or segmentation to reduce exposure. Obtain and deploy a vendor-provided update when a fixed release is identified.
outcome
Run in progress: no artifact yet.
source signals
Public signals that triggered or updated the pipeline. These are inputs for the deltas above.
- 2026-11-12 21:13Zghsa: trigger signal, started the run
- 2026-11-12 21:13Zcve.org record for CVE-2026-91141
this entry in the feed
GET /api/v1/feed/CVE-2026-91141
{ "etk_id": "ETK-2026-4335", "cve_id": "CVE-2026-91141", "display_id": "CVE-2026-91141", "ghsa_id": "GHSA-vvxx-jj9c-53w8", "euvd_id": null, "status": "in_pipeline", "anchor_state": "anchored", "title": "Unauthenticated memory exhaustion in COVESA vSomeIp", "summary": "COVESA vSomeIp in its default configuration can allocate excessive memory when processing a TCP message with an attacker-controlled SOME/IP length. A remote unauthenticated attacker may cause service termination or exhaust host memory. Exploitation requires network access to a reachable vSomeIp TCP endpoint.", "mitigation": "Restrict network access to vSomeIp TCP endpoints to trusted peers and apply connection-level filtering or segmentation to reduce exposure. Obtain and deploy a vendor-provided update when a fixed release is identified.", "vendor": "COVESA", "product": "vSomeIp", "affected": [], "cwes": null, "cvss_score": null, "cvss_src": null, "cvss_vector": null, "epss_score": null, "epss_percentile": null, "epss_asof": null, "automation": null, "check": false, "check_confidence_basis": null, "exploit": false, "pipeline_minutes": null, "t0_at": "2026-11-12T21:13:23.814000+00:00", "signals": { "trigger_signal": { "at": "2026-11-12T21:13:23.814000+00:00", "days": 0, "is_lower_bound": false, "measured_at": "2026-11-12T21:13:23.814000+00:00", "url": "https://github.com/advisories/GHSA-vvxx-jj9c-53w8" } } }
published 2026-11-13 00:49Z
last change 2026-11-13 00:49Z
Need the technical details behind an entry?
Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.