CVE-2026-22591

eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to versions 2.6.12, 2.14.6, 3.2.4, and 3.4.3, Fast DDS’s implementation of SQL‑based content filtering (DDSSQLFilter) allows any participant in a DDS domain to remotely crash other Fast DDS participants by sending a single crafted SEDP `DATA` submessage whose `PID_CONTENT_FILTER_PROPERTY.filterExpression` contains a deeply nested filter expression. Versions 2.6.12, 2.14.6, 3.2.4, and 3.4.3 fix the issue.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-7577-rf2r-j88m
https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-7577-rf2r-j88m

Configurations

No configuration.

History

No history.

Information

Published : 2026-09-09 16:17

Updated : 2026-09-14 14:17

NVD link : CVE-2026-22591

Mitre link : CVE-2026-22591

CVE.ORG link : CVE-2026-22591

JSON object : View

Products Affected

No product.

CWE

CWE-400

Uncontrolled Resource Consumption

CWE-674

Uncontrolled Recursion

{"id": "CVE-2026-22591", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22591", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-14T13:37:51.626408Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "eProsima", "product": "Fast-DDS", "versions": [{"status": "affected", "version": "< 2.6.12"}, {"status": "affected", "version": ">= 2.7.0, < 2.14.6"}, {"status": "affected", "version": ">= 3.0.0, < 3.2.4"}, {"status": "affected", "version": ">= 3.4.0, < 3.4.3"}]}]}], "published": "2026-09-09T16:17:02.563", "references": [{"url": "https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-7577-rf2r-j88m", "source": "security-advisories@github.com"}, {"url": "https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-7577-rf2r-j88m", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-674"}]}], "descriptions": [{"lang": "en", "value": "eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to versions 2.6.12, 2.14.6, 3.2.4, and 3.4.3, Fast DDS\u2019s implementation of SQL\u2011based content filtering (DDSSQLFilter) allows any participant in a DDS domain to remotely crash other Fast DDS participants by sending a single crafted SEDP `DATA` submessage whose `PID_CONTENT_FILTER_PROPERTY.filterExpression` contains a deeply nested filter expression. Versions 2.6.12, 2.14.6, 3.2.4, and 3.4.3 fix the issue."}], "lastModified": "2026-09-14T14:17:07.377", "sourceIdentifier": "security-advisories@github.com"}