CVE-2026-71641 Details

A denial-of-service vulnerability has been identified in ZJU-FAST-Lab EGO-Planner-v2, all versions prior to commit 5c99a95880401e2599638d567abc0e240396cb42. The issue arises from the interaction between the 'traj_server', 'poscmd_2_odom', and the 'EGOReplanFSM' emergency recovery logic. When a UAV's trajectory ends, 'traj_server' stops publishing position commands, including necessary zero-velocity updates. Meanwhile, 'poscmd_2_odom' continues to send the last received command, which may still include a non-zero velocity. This stale data can cause the odometry to incorrectly report movement, preventing the 'EGOReplanFSM' from transitioning out of an emergency stop state, effectively leaving the UAV stuck and unavailable for further tasks.

To address this vulnerability, 'traj_server' should be modified to publish a final hover command with zero velocity, acceleration, and jerk after a trajectory ends. Additionally, 'poscmd_2_odom' should implement a timeout for stale commands to prevent the last non-zero velocity from being retained indefinitely. As a further safeguard, the 'EGOReplanFSM' could be programmed to handle prolonged emergency stops by treating the UAV as stopped or entering a dedicated fault state.