{"id":"CVE-2026-91141","kind":"vulnerability","aliases":["CVE-2026-91141"],"related":[],"title":"vsomeip: remote TCP packet forces massive memory allocation and service crash","description":"A vulnerability in the default configuration of vsomeip allows a remote, unauthenticated attacker to trigger massive memory allocations by sending a small TCP packet with a large, attacker-declared SOME/IP length field. This can lead to immediate service termination via OOM-kill on memory-constrained systems or total host memory exhaustion through repeated connections.","summary":"vsomeip, a SOME/IP middleware library used in automotive and embedded systems, trusts a length field in incoming TCP packets. A remote attacker can send a small packet declaring a huge length, making the service allocate large memory and get killed or exhaust host memory.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"vsomeip","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["automotive","embedded","other","some-ip","vsomeip"],"not_affected_if":["tcp-port-not-exposed","vsomeip-not-used"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-12T22:19:29+00:00","first_seen_at":"2026-11-12T22:40:38+00:00","triaged_at":"2026-11-12T22:42:38+00:00","updated_at":"2026-11-12T22:42:38+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-12T22:42:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"vsomeip: remote TCP packet forces massive memory allocation and service crash","impact":"medium","summary":"vsomeip, a SOME/IP middleware library used in automotive and embedded systems, trusts a length field in incoming TCP packets. A remote attacker can send a small packet declaring a huge length, making the service allocate large memory and get killed or exhaust host memory.","audience":"businesses","category":"other","nicknames":[],"who_cares":["vsomeip","automotive","embedded","some-ip"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"remote attacker crashes service or exhausts host memory","analyst_note":"Find affected and fixed vsomeip versions and the default-config setting from the vendor advisory or NVD CPE data; the sources given name neither.","how_to_check":"unknown","plain_action":"","product_name":"vsomeip","needs_analyst":true,"not_affected_if":["vsomeip-not-used","tcp-port-not-exposed"],"who_is_affected":"Systems running vsomeip in its default configuration with TCP reachable from the network are exposed, per the NVD description. Systems that do not run vsomeip, or that restrict its TCP port, are not described as affected. The sources do not list affected versions or a configuration check.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000713,"input_tokens":4565,"output_tokens":512,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-91141':14A,17A 'alloc':8A,60B,87C 'allow':78C 'attack':47B,82C,98C 'attacker-declar':97C 'automot':19B,33B 'configur':75C 'connect':126C 'constrain':117C 'crash':11A 'cve':12A,15A 'declar':53B,99C 'default':74C 'embed':20B,35B 'exhaust':67B,123C 'field':40B,102C 'forc':5A 'get':64B 'host':68B,121C 'huge':55B 'immedi':107C 'incom':42B 'ip':24B 'kill':65B,113C 'larg':61B,96C 'lead':105C 'length':39B,56B,101C 'librari':30B 'make':57B 'massiv':6A,85C 'memori':7A,62B,69B,86C,116C,122C 'memory-constrain':115C 'middlewar':29B 'oom':112C 'oom-kil':111C 'packet':4A,44B,52B,93C 'remot':2A,46B,80C 'repeat':125C 'send':49B,89C 'servic':10A,59B,108C 'small':51B,91C 'some-ip':22B 'some/ip':28B,100C 'system':36B,118C 'tcp':3A,43B,92C 'termin':109C 'total':120C 'trigger':84C 'trust':37B 'unauthent':81C 'use':31B 'via':110C 'vsomeip':1A,18A,25B,26B,77C 'vulner':71C","nicknames":[],"mitigations":[],"who_affected":"Systems running vsomeip in its default configuration with TCP reachable from the network are exposed, per the NVD description. Systems that do not run vsomeip, or that restrict its TCP port, are not described as affected. The sources do not list affected versions or a configuration check.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["vsomeip"],"ptokens":["vsomeip"],"labels":["automotive","embedded","other","someip","unknown","vendor","vsomeip"],"campaign_type":null,"search_a":"'-2026':13A,16A '-91141':14A,17A 'alloc':8A 'crash':11A 'cve':12A,15A 'forc':5A 'massiv':6A 'memori':7A 'packet':4A 'remot':2A 'servic':10A 'tcp':3A 'vsomeip':1A,18A","search_b":"'alloc':60B 'attack':47B 'automot':19B,33B 'declar':53B 'embed':20B,35B 'exhaust':67B 'field':40B 'get':64B 'host':68B 'huge':55B 'incom':42B 'ip':24B 'kill':65B 'larg':61B 'length':39B,56B 'librari':30B 'make':57B 'memori':62B,69B 'middlewar':29B 'packet':44B,52B 'remot':46B 'send':49B 'servic':59B 'small':51B 'some-ip':22B 'some/ip':28B 'system':36B 'tcp':43B 'trust':37B 'use':31B 'vsomeip':25B,26B","search_c":"'alloc':87C 'allow':78C 'attack':82C,98C 'attacker-declar':97C 'configur':75C 'connect':126C 'constrain':117C 'declar':99C 'default':74C 'exhaust':123C 'field':102C 'host':121C 'immedi':107C 'kill':113C 'larg':96C 'lead':105C 'length':101C 'massiv':85C 'memori':86C,116C,122C 'memory-constrain':115C 'oom':112C 'oom-kil':111C 'packet':93C 'remot':80C 'repeat':125C 'send':89C 'servic':108C 'small':91C 'some/ip':100C 'system':118C 'tcp':92C 'termin':109C 'total':120C 'trigger':84C 'unauthent':81C 'via':110C 'vsomeip':77C 'vulner':71C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T22:19:29+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91141","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91141","severity":null,"published_at":"2026-11-12T22:19:29+00:00","modified_at":"2026-11-12T22:19:29+00:00","first_seen_at":"2026-11-12T22:40:38+00:00","fetched_at":"2026-11-12T22:40:38+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}