Uncontrolled Recursion in Fast DDS - CVE-2026-22591
Published: November 9, 2026
Vulnerability identifier: #VU162808
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-22591
CWE-ID: CWE-674
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to crash Fast DDS participants with DDSSQLFilter-enabled writers when DDS Security is disabled.
The vulnerability exists due to missing recursion depth limits in the DDSSQLFilter parser when processing deeply nested filter expressions received through subscription discovery traffic. An unauthenticated remote attacker can join the DDS domain and complete discovery before sending a single crafted SEDP subscription message that exhausts the victim's stack and terminates its process.
Affected software
Fast DDS
How to mitigate CVE-2026-22591
Install security update from vendor's website.
Fast DDS - addressed in versions 2.6.12, 2.14.7, 3.2.4, 3.4.3