CVE-2026-91141

Not enough EPSS history yet.

A vulnerability in the default configuration of vsomeip allows a remote, unauthenticated attacker to trigger massive memory allocations by sending a small TCP packet with a large, attacker-declared SOME/IP length field. This can lead to immediate service termination via OOM-kill on memory-constrained systems or total host memory exhaustion through repeated connections.

• biackr0se.github.iohttps://biackr0se.github.io/posts/cve-2026-91141-vsomeip/
• kb.cert.orghttps://kb.cert.org/vuls/id/128947
• www.kb.cert.orghttps://www.kb.cert.org/vuls/id/128947

No related CVEs by CWE or product.