CVE-2026-22591: Fast DDS DDSSQLFilter Recursive Parser Stack Exhaustion (Remote DoS)
eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to versions 2.6.12, 2.14.6, 3.2.4, and 3.4.3, Fast DDS’s implementation of SQL‑based content filtering (DDSSQLFilter) allows any participant in a DDS domain to remotely crash other Fast DDS participants by sending a single crafted SEDP DATA submessage whose PIDCONTENTFILTERPROPERTY.filterExpression contains a deeply nested filter expression. Versions 2.6.12, 2.14.6, 3.2.4, and 3.4.3 fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
eprosima Fast DDSto a version that resolves this vulnerability.Fixed in 2.6.12 - Upgrade
Upgrade
eprosima Fast DDSto a version that resolves this vulnerability.Fixed in 2.14.6 - Upgrade
Upgrade
eprosima Fast DDSto a version that resolves this vulnerability.Fixed in 3.2.4 - Upgrade
Upgrade
eprosima Fast DDSto a version that resolves this vulnerability.Fixed in 3.4.3
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Fast DDS participants running versions earlier than 2.6.12, 2.14.6, 3.2.4, or 3.4.3 are exposed when they participate in a DDS domain where an attacker can send SEDP DATA submessages. The attacker can be any participant in that DDS domain.
Does exploitation require credentials, user interaction, or multiple requests?
No credentials or user interaction are required. A single crafted SEDP DATA submessage containing a deeply nested DDSSQLFilter filterExpression can crash affected participants.
What is the impact of successful exploitation?
Successful exploitation causes a remote denial of service by exhausting the parser stack and crashing Fast DDS participants. The provided data does not indicate confidentiality or integrity impact.
Which versions contain the fix?
The issue is fixed in Fast DDS versions 2.6.12, 2.14.6, 3.2.4, and 3.4.3.