Read the docs
TI-2026-18152 Aliases CVE-2026-22591

Fast DDS DDSSQLFilter Recursive Parser Stack Exhaustion (Remote DoS)

Priority HIGH 72CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to versions 2.6.12, 2.14.6, 3.2.4, and 3.4.3, Fast DDS’s implementation of SQL‑based content filtering (DDSSQLFilter) allows any participant in a DDS domain to remotely crash other Fast DDS participants by sending a single crafted SEDP `DATA` submessage whose `PID_CONTENT_FILTER_PROPERTY.filterExpression` contains a deeply nested filter expression. Versions 2.6.12, 2.14.6, 3.2.4, and 3.4.3 fix the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0046 40th percentileScored 2026-11-07
Fix Fixed Fast-DDS (eProsima): 2.6.12, 2.14.6, 3.2.4 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
eProsimaFast-DDSbefore 2.6.12; 2.7.0 to before 2.14.6; 3.0.0 to before 3.2.4; 3.4.0 to before 3.4.32.6.12, 2.14.6, 3.2.4, 3.4.3Patch availableCNA
  • Fast-DDS VendoreProsima Affected before 2.6.12; 2.7.0 to before 2.14.6; 3.0.0 to before 3.2.4; 3.4.0 to before 3.4.3 Fixed in 2.6.12, 2.14.6, 3.2.4, 3.4.3 Patch available CNA

Remediation

  • Fix · CNA Fast-DDS (eProsima) Fixed in 2.6.12, 2.14.6, 3.2.4, 3.4.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-22591

References

Other 1

  • TI-2026-18151 Fast-DDS Discovery Server: Out-of-Bounds Read & Heap Memory Disclosure via DATA_FRAG sampleSize / fragmentsInSubmessage CVSS 3.1CRITICAL 9.1
  • TI-2025-38815 Integer overflow in eProsima Fast-DDS CVSS 3.1HIGH 8.6
  • TI-2024-18790 Manipulated DATA Submessage causes a heap-buffer-overflow error CVSS 3.1CRITICAL 9.7
  • TI-2023-27485 Disconnect Vulnerability in RTPS Packets Used by SROS2 CVSS 3.1CRITICAL 9.7
  • TI-2024-20005 FastDDS heap buffer overflow when publisher sends malformed packet CVSS 3.1HIGH 8.2
  • TI-2023-20840 Another heap overflow in push_back_helper CVSS 3.1HIGH 8.2
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences