Allocation of Resources Without Limits or Throttling in Fast DDS - CVE-2026-45092
Published: November 9, 2026
Vulnerability identifier: #VU162809
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-45092
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to exhaust memory and terminate a Fast DDS process, causing denial of service.
The vulnerability exists due to unbounded participant tracking in SecurityManager when DDS Security is compiled in and activated with valid governance and permissions files. An unauthenticated remote attacker can send numerous forged SPDP discovery messages with distinct participant GUIDs to the target's UDP discovery address, causing continuous memory allocation until the process is killed without requiring user interaction.
Affected software
Fast DDS
How to mitigate CVE-2026-45092
Install security update from vendor's website.
Fast DDS - addressed in versions 2.6.12, 2.14.7, 3.2.5, 3.4.3, 3.6.2