Description
eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to versions 2.6.12, 2.14.6, 3.2.4, and 3.4.3, Fast DDS’s implementation of SQL‑based content filtering (DDSSQLFilter) allows any participant in a DDS domain to remotely crash other Fast DDS participants by sending a single crafted SEDP `DATA` submessage whose `PID_CONTENT_FILTER_PROPERTY.filterExpression` contains a deeply nested filter expression. Versions 2.6.12, 2.14.6, 3.2.4, and 3.4.3 fix the issue.
Published: 2026-09-09
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A recursion error in Fast DDS’s DDSSQLFilter causes a stack exhaustion when parsing a deeply nested filter expression supplied in a SEDP DATA submessage. An attacker who can send such a message to a DDS domain participant can force that participant to crash, terminating its service without gaining code execution or compromising data confidentiality. The flaw is strictly a denial‑of‑service vulnerability.

Affected Systems

eProsima Fast‑DDS releases prior to 2.6.12, 2.14.6, 3.2.4, and 3.4.3 are vulnerable. Any participant running one of these versions in a DDS domain is affected. All newer releases contain the fix.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity DoS risk. EPSS information is unavailable, but the vulnerability can be triggered remotely by any participant that can craft a SEDP DATA submessage with a malicious filter. Although KEV does not list this entry, the remote attack surface and potential for distributed denial of service warrant close monitoring. The flaw requires only message construction and network transmission; no local privilege escalation is needed.

Generated by OpenCVE AI on September 9, 2026 at 17:26 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade eProsima Fast‑DDS to version 2.6.12 or later, or 2.14.6, 3.2.4, 3.4.3 or newer, to apply the stack‑exhaustion fix.
  • If the content‑filter feature is not required, disable DDSSQLFilter or block SEDP DATA submessages carrying filter expressions through network policies or firewalls.
  • Implement monitoring of DDS application uptime and detect sudden restarts or crashes to quickly identify exploitation attempts.

Generated by OpenCVE AI on September 9, 2026 at 17:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 09 Sep 2026 16:00:00 +0000

Type Values Removed Values Added
Description eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to versions 2.6.12, 2.14.6, 3.2.4, and 3.4.3, Fast DDS’s implementation of SQL‑based content filtering (DDSSQLFilter) allows any participant in a DDS domain to remotely crash other Fast DDS participants by sending a single crafted SEDP `DATA` submessage whose `PID_CONTENT_FILTER_PROPERTY.filterExpression` contains a deeply nested filter expression. Versions 2.6.12, 2.14.6, 3.2.4, and 3.4.3 fix the issue.
Title Fast DDS DDSSQLFilter Recursive Parser Stack Exhaustion (Remote DoS)
Weaknesses CWE-400
CWE-674
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-09T15:47:17.533Z

Reserved: 2026-01-07T21:50:39.532Z

Link: CVE-2026-22591

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-09T16:17:02.563

Modified: 2026-09-09T16:17:02.563

Link: CVE-2026-22591

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-09T17:30:07Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-674

    Uncontrolled Recursion