https://vulnerability.circl.lu/sightings/feed 2026-09-10T20:42:39.657106+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/b45cc3b0-442d-424e-9108-b5f7dd9a87d2/export 2026-09-10T20:42:39.679870+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "b45cc3b0-442d-424e-9108-b5f7dd9a87d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71645", "type": "seen", "source": "https://gist.github.com/DongJiaxin0422/5c01ce9ab3211463b20dc8e86e6464de", "content": "# CVE-2026-71645\n\n[CVE ID]\n\nCVE-2026-71645\n\n\n[PRODUCT]\n\nRACER\n\n\n[VERSION]\n\nRACER commit abcdef1234567890.\n\n\n[PROBLEM TYPE]\n\nDenial of Service (DoS) caused by an unbounded trajectory-planning retry loop in the exploration state machine.\n\n\n[DESCRIPTION]\n\nRACER contains an issue in the exploration state machine where a UAV may remain indefinitely in the `PLAN_TRAJ` state when the currently selected `next_viewpoint` becomes unreachable.\n\nWhen trajectory planning returns `FAIL`, the FSM only sets `fd_->static_state_ = true` and remains in `PLAN_TRAJ`. It does not limit the number of retries, invalidate the unreachable target, select another viewpoint or frontier, or transition to an alternative recovery state.\n\nIf A* cannot find a path to the current `next_pos_`, `planTrajToView()` returns `FAIL`. During collision-avoidance or return-related replanning, the system may continue attempting to plan toward the same existing `next_pos_` instead of performing a complete exploration-planning cycle and selecting a different target.\n\nAs a result, the FSM can repeatedly attempt to reach the same unreachable viewpoint without making exploration progress.\n\n\n[IMPACT]\n\nAn affected UAV may become trapped in a persistent replanning loop and stop making exploration progress.\n\nThe UAV can repeatedly execute unsuccessful A* searches and trajectory-planning operations, continuously generate warning and error logs, and fail to select another reachable frontier or viewpoint.\n\nThis condition can persist until the mission or experiment times out, resulting in denial of service and mission incompletion. In multi-UAV exploration, the affected UAV may also reduce overall swarm exploration efficiency because it remains assigned to an unreachable or temporarily blocked target.\n\n\n[ROOT CAUSE]\n\nThe exploration FSM does not implement a bounded recovery mechanism for repeated trajectory-planning failures involving the same target.\n\nWhen `callExplorationPlanner()` returns `FAIL` in `PLAN_TRAJ`, the failure branch only sets `fd_->static_state_ = true`. It does not increment a retry counter, mark the current viewpoint as unreachable, invalidate `next_pos_`, trigger frontier reselection, or transition to another recovery state.\n\nIn addition, when replanning is triggered by collision avoidance or return behavior, the planner can continue calling `planTrajToView()` using the existing `ed_->next_pos_` and `ed_->next_yaw_`. Therefore, an unreachable target may be retried repeatedly without forcing a new exploration-planning decision.\n\nThe absence of retry bounds, target invalidation, target reselection, and fallback-state handling allows the FSM to remain indefinitely in `PLAN_TRAJ`.", "creation_timestamp": "2026-09-08T08:19:53.454130Z"} 2026-09-08T08:19:53.454130+00:00