https://vulnerability.circl.lu/sightings/feed 2026-09-10T21:43:42.328957+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/c0bc52f4-c623-45a9-8420-0c003826853f/export 2026-09-10T21:43:42.350725+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "c0bc52f4-c623-45a9-8420-0c003826853f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71646", "type": "seen", "source": "https://gist.github.com/DongJiaxin0422/747d8e6c8afc0a364454b741b39bb98c", "content": "# CVE-2026-71646\n\n[CVE ID]\n\nCVE-2026-71646\n\n\n[PRODUCT]\n\nRACER\n\n\n[VERSION]\n\nRACER commit abcdef1234567890.\n\n\n[PROBLEM TYPE]\n\nDenial of Service (DoS) caused by a cooldown bypass in repeated pair-opt attempts.\n\n\n[DESCRIPTION]\n\nRACER contains an issue in `FastExplorationFSM::optTimerCallback()` where failed pair-opt attempts can bypass the intended attempt cooldown and be retried at timer frequency.\n\nThe pair-opt mechanism uses `recent_attempt_time_` together with `attempt_interval_` to prevent repeated optimization attempts within a short time interval.\n\nHowever, when a pair-opt attempt determines that the reallocated assignment has a higher cost, the callback may return immediately before updating `recent_attempt_time_`.\n\nBecause the failed attempt is not recorded by the cooldown mechanism, the next invocation of `optTimerCallback()` can immediately pass the same cooldown check and execute the same pair-opt computation again.\n\nIf the same condition persists, the callback repeatedly performs the failed pair-opt operation at timer frequency.\n\n\n[IMPACT]\n\nAn affected UAV may repeatedly execute unsuccessful pair-opt computations without respecting the configured cooldown interval.\n\nThis can cause excessive CPU consumption, repeated error logging, and unnecessary task-reallocation processing. The repeated optimization attempts may also interfere with normal exploration-state-machine execution and reduce overall exploration progress.\n\nIf the condition persists, the affected system may spend substantial computation repeatedly processing the same failed pair-opt operation, resulting in denial of service or mission degradation.\n\n\n[ROOT CAUSE]\n\nThe cooldown timestamp `recent_attempt_time_` is updated only after the pair-opt processing reaches a later stage of `optTimerCallback()`.\n\nWhen the reallocated assignment is determined to have a higher cost, the callback executes an early `return` before this timestamp update occurs.\n\nAs a result, the failed pair-opt attempt is not recorded as an attempt. On the next timer invocation, the elapsed-time check against `attempt_interval_` still succeeds, allowing the same pair-opt operation to be retried immediately.\n\nThe cooldown mechanism therefore applies only to attempts that reach the later timestamp-update path, rather than to all pair-opt attempts. This control-flow ordering allows rejected pair-opt attempts to bypass the intended rate limit and repeat at timer frequency.", "creation_timestamp": "2026-09-08T08:22:24.831406Z"} 2026-09-08T08:22:24.831406+00:00