CVE-2026-71645 Details

A denial-of-service vulnerability has been identified in the RACER project by Robotics-STAR-Lab, specifically in commit abcdef1234567890. The issue arises within the exploration state machine, where a UAV can become stuck in a continuous retry loop when the selected viewpoint becomes unreachable. This loop prevents the UAV from making progress in its exploration tasks, as it repeatedly attempts to plan a trajectory to an inaccessible location without successfully completing the task.

To address this vulnerability, a bounded recovery mechanism should be implemented. This could involve maintaining a failure counter for the current viewpoint, resetting it when the target changes or planning succeeds, and marking the viewpoint as temporarily unreachable after a certain number of consecutive failures. The exploration state machine could then be forced to select a new target or transition to a fallback state, such as 'IDLE', if no reachable viewpoints are available.