Description

eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to versions 2.6.12, 2.14.6, 3.2.4, and 3.4.3, Fast DDS’s implementation of SQL‑based content filtering (DDSSQLFilter) allows any participant in a DDS domain to remotely crash other Fast DDS participants by sending a single crafted SEDP `DATA` submessage whose `PID_CONTENT_FILTER_PROPERTY.filterExpression` contains a deeply nested filter expression. Versions 2.6.12, 2.14.6, 3.2.4, and 3.4.3 fix the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-09T16:17:02.563Z",
  "pubdate": "2026-09-09T16:17:02.563Z",
  "executiveSummary": "eProsima Fast DDS contains a critical remote denial-of-service (DoS) vulnerability within its SQL-based content filtering implementation (DDSSQLFilter).\nThe vulnerability allows an unauthenticated remote attacker, acting as a participant within the same DDS domain, to trigger a crash in target Fast DDS participants.\nExploitation is achieved by transmitting a malformed SEDP (Simple Endpoint Discovery Protocol) DATA submessage containing a deeply nested filter expression within the PID_CONTENT_FILTER_PROPERTY.filterExpression parameter.\nThis flaw forces the target application into an unstable state, resulting in a process crash and service interruption.\nThe risk is high for industrial and robotic systems relying on Fast DDS for real-time communication, as it requires no prior authentication to the target process and can be initiated by any participant sharing the same DDS domain.\nAffected versions include Fast DDS prior to 2.6.12, 2.14.6, 3.2.4, and 3.4.3.",
  "technicalDetails": "The vulnerability resides in the DDSSQLFilter component of eProsima Fast DDS, specifically in how the library parses and evaluates SQL-based content filter expressions provided in SEDP discovery messages.\nThe root cause is an insecure handling of recursive or deeply nested structures within the filter expression grammar during the parsing phase. When the DDSSQLFilter parser processes the PID_CONTENT_FILTER_PROPERTY.filterExpression string, it lacks sufficient depth validation or recursion limits for the expression tree.\nAttackers can leverage this by crafting a maliciously structured SQL filter expression—specifically one with excessive nesting—and encapsulating it within an SEDP DATA submessage. Because SEDP messages are used during the discovery phase of DDS participants, this interaction occurs automatically when a new participant joins or updates its properties within the DDS domain.\nThe attack flow is as follows: 1) The attacker injects a malicious SEDP DATA submessage into the DDS domain; 2) The victim's Fast DDS instance receives this message; 3) The Discovery mechanism processes the submessage and extracts the PID_CONTENT_FILTER_PROPERTY; 4) The DDSSQLFilter component attempts to parse the 'filterExpression' field; 5) Due to the deep nesting, the parser causes a stack overflow or a critical error in the logic handling the expression tree, resulting in an unhandled exception or memory corruption; 6) The target process terminates unexpectedly, leading to a complete Denial of Service.\nThe vulnerability does not require authentication; being a member of the DDS domain is sufficient to send SEDP traffic. Exposure is limited to the network segment where DDS discovery is conducted, but any node successfully injecting traffic into the domain is capable of exploitation.\nThe impacted versions are: Fast DDS prior to 2.6.12, 2.14.6, 3.2.4, and 3.4.3."
}