Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-22591

Fast DDS DDSSQLFilter Recursive Parser Stack Exhaustion (Remote DoS)

CVSS 3.1 7.5 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-22591

Published

eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to versions 2.6.12, 2.14.6, 3.2.4, and 3.4.3, Fast DDS’s implementation of SQL‑based content filtering (DDSSQLFilter) allows any participant in a DDS domain to remotely crash other Fast DDS participants by sending a single crafted SEDP `DATA` submessage whose `PID_CONTENT_FILTER_PROPERTY.filterExpression` contains a deeply nested filter expression. Versions 2.6.12, 2.14.6, 3.2.4, and 3.4.3 fix the issue.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-22591

Published

Fast-DDS

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "eProsima",
                    "product": "Fast-DDS",
                    "versions": [
                        {
                            "version": "< 2.6.12",
                            "status": "affected"
                        },
                        {
                            "version": ">= 2.7.0, < 2.14.6",
                            "status": "affected"
                        },
                        {
                            "version": ">= 3.0.0, < 3.2.4",
                            "status": "affected"
                        },
                        {
                            "version": ">= 3.4.0, < 3.4.3",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON