Vulnerability · Published Sep 9, 2026 · Assigned by GitHub_M

CVE-2026-22591Fast DDS DDSSQLFilter Recursive Parser Stack Exhaustion (Remote DoS)

High 7.5

In plain English

A high-severity uncontrolled resource consumption in Fast-DDS from eProsima. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 60.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to versions 2.6.12, 2.14.6, 3.2.4, and 3.4.3, Fast DDS’s implementation of SQL‑based content filtering (DDSSQLFilter) allows any participant in a DDS domain to remotely crash other Fast DDS participants by sending a single crafted SEDP `DATA` submessage whose `PID_CONTENT_FILTER_PROPERTY.filterExpression` contains a deeply nested filter expression. Versions 2.6.12, 2.14.6, 3.2.4, and 3.4.3 fix the issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	fastdds	no fix listed	DEBIAN-CVE-2026-22591
Debian:13	fastdds	no fix listed	DEBIAN-CVE-2026-22591
Ubuntu:24.04:LTS	fastdds	no fix listed	UBUNTU-CVE-2026-22591
Ubuntu:26.04:LTS	fastdds	no fix listed	UBUNTU-CVE-2026-22591
Ubuntu:26.10	fastdds	no fix listed	UBUNTU-CVE-2026-22591

Affected products (as reported)

Vendor	Product	Versions
eProsima	Fast-DDS	< 2.6.12>= 2.7.0, < 2.14.6>= 3.0.0, < 3.2.4>= 3.4.0, < 3.4.3

Weakness: CWE-400, CWE-674 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-7577-rf2r-j88m x_refsource_CONFIRM