Loading vulnerability…
Heap buffer overflow in cannelloni 2.0.0 CAN frame parsing
CVE-2026-37539 is a buffer overflow vulnerability in cannelloni v2.0.0 affecting CAN frame parsing logic in parser.cpp::parseCANFrame and decoder.cpp::decodeFrame. The available context indicates that cannelloni accepts CAN traffic tunneled over UDP, TCP, or SCTP, and that attacker-controlled frame counts and per-frame data lengths are processed without adequate bounds checking before frame data is written into the receive buffer. Crafted CAN FD frames can therefore trigger out-of-bounds memory writes during parsing/decoding. Although one source labels the issue generally as a buffer overflow and another specifically as a heap buffer overflow, both indicate unsafe length handling in the CAN frame parsing path.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A remote, unauthenticated attacker can send crafted CAN FD frames to a reachable cannelloni instance and trigger memory corruption. Confirmed impact includes denial of service via process crash. The CVE record and supporting context further indicate possible arbitrary code execution, implying potential compromise of confidentiality, integrity, and availability of the affected process or host. The provided CVSS v3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects critical severity.
If you can’t patch tonight, do this now.
Until a fix is deployed, restrict network exposure of cannelloni services that accept tunneled CAN traffic over UDP, TCP, or SCTP. Limit access to trusted peers only using network segmentation, firewall rules, ACLs, VPNs, or equivalent controls. Disable cannelloni where not required, and avoid accepting untrusted or Internet-reachable CAN tunneling traffic. Monitoring for malformed or anomalous CAN FD frame traffic may reduce exposure but is not a substitute for patching.
Patch, then assume compromise.
Upgrade from cannelloni v2.0.0 to a fixed release if one is available from the vendor or project maintainer. The vulnerable parsing logic in parseCANFrame and decodeFrame should be corrected to validate attacker-controlled frame counts and per-frame lengths before allocation, copy, or write operations, and to enforce strict bounds checks on receive-buffer writes for CAN FD payload handling. If no patched release is currently available, the information is currently not available beyond avoiding the affected version.
No public exploits tracked yet. Mallory keeps watching.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.