CVE-2026-71643 Details

A denial-of-service vulnerability has been identified in ZJU-FAST-Lab EGO-Planner-v2, affecting all versions prior to commit 5c99a95880401e2599638d567abc0e240396cb42. The issue arises in the EGOReplanFSM component, where inconsistent collision semantics during post-emergency recovery can lead to UAVs becoming stuck in a loop of failed recovery attempts. This occurs because the safety checker and trajectory optimizer apply different models and thresholds for collision clearance, causing UAVs to be incorrectly assessed as safely separated or as permanent obstacles.

To address this vulnerability, the emergency-stop trajectory generation should be re-enabled after a successful safety replanning. This can be done by modifying the recovery logic to ensure that the 'flag_escape_emergency_' is set to true again, allowing the UAV to refresh its stop trajectory and resume normal operations.