CVE-2026-91141

{
  "etk_id": "ETK-2026-4335",
  "cve_id": "CVE-2026-91141",
  "display_id": "CVE-2026-91141",
  "ghsa_id": "GHSA-vvxx-jj9c-53w8",
  "euvd_id": "EUVD-2026-124718",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Remote memory exhaustion in COVESA vSomeIp TCP handling",
  "summary": "COVESA vSomeIp deployments using the default configuration are affected when their TCP/SOME-IP service is reachable by an untrusted network client. An unauthenticated attacker can cause excessive memory consumption, potentially terminating the service or exhausting host memory. Network reachability to the affected TCP endpoint is required.",
  "mitigation": "Restrict access to vSomeIp TCP endpoints with network segmentation and firewall rules, allowing only trusted peers. Apply host or container memory limits where practical and monitor for a vendor update.",
  "vendor": "COVESA",
  "product": "vSomeIp",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= v3.6.1, < 3.7.4"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "3.7.4"
      ],
      "package_name": "vSomeIp",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 89.1208138,
  "t0_at": "2026-11-12T21:13:23.814000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-12T21:13:23.814000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-12T21:13:23.814000+00:00",
      "url": "https://github.com/advisories/GHSA-vvxx-jj9c-53w8"
    }
  }
}