CVE-2026-71646 Details

A denial-of-service vulnerability has been identified in the Robotics-STAR-Lab RACER Tested version commit abcdef1234567890. The issue arises in the FastExplorationFSM::optTimerCallback() function, where an attacker can exploit a cooldown bypass in the pair-optimization mechanism. When a pair-optimization attempt is unsuccessful, the system fails to update the cooldown timestamp, allowing the same operation to be retried immediately at timer frequency. This can lead to excessive CPU usage, repeated error logging, and interference with normal exploration processes, causing mission degradation.

To address this vulnerability, the cooldown timestamp should be updated at the start of each pair-optimization attempt, rather than only after a successful reallocation. This ensures that all attempts, including failed ones, are subject to the cooldown interval, preventing repeated failures from consuming excessive CPU resources and disrupting normal operations.