CVE-2026-91141: Security vulnerability
A vulnerability in the default configuration of vsomeip allows a remote, unauthenticated attacker to trigger massive memory allocations by sending a small TCP packet with a large, attacker-declared SOME/IP length field. This can lead to immediate service termination via OOM-kill on memory-constrained systems or total host memory exhaustion through repeated connections.
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using vsomeip in its default configuration are exposed if a remote attacker can establish a TCP connection to the affected service.
What does an attacker need to exploit this issue?
The attacker needs only network access to send a small TCP packet containing a large attacker-declared SOME/IP length field. No authentication is required.
What is the likely operational impact?
On memory-constrained systems, the service can terminate immediately due to an OOM kill. Repeated connections can also exhaust memory across the host.