CVE-2026-71647

CVE-2026-71647 is an uncontrolled resource consumption flaw (CWE-400) in EGO-Planner-v2, affecting all versions up to commit 5c99a95880401e2599638d567abc0e240396cb42. An attacker can reach the planner over the network without authentication or user interaction and trigger excessive resource consumption through the checkCollisionCallback, execFSMCallback, and planFromGlobalTraj functions in ego_replan_fsm.cpp. The result is a denial of service: the planner's finite state machine stalls or fails, with high availability impact but no effect on confidentiality or integrity. Anyone running EGO-Planner-v2 up to the affected commit — typically researchers, robotics labs, and UAV developers using this open-source drone trajectory planner — is affected. There is no public proof-of-concept, the flaw is not in CISA's KEV, and no exploitation is currently known.

What to do: Operators should monitor the upstream EGO-Planner-v2 repository and update to a commit newer than 5c99a95880401e2599638d567abc0e240396cb42 once a fix is published, since no fixed version is identified in the advisory. In the meantime, restrict network access to the planner's ROS communication endpoints so only trusted hosts can send planning inputs, and note that the practical impact is interruption of drone planning rather than data compromise.