AIKIDO-2026-946595

eProsima.Fast-DDS is vulnerable to Denial of Service (DoS)

Denial of Service (DoS)CVE-2025-65016 Published Today

High Risk

This Affects:

eProsima.Fast-DDS

0.0.1 - 2.6.10

Fixed in 2.6.11

2.7.0 - 2.14.5

Fixed in 2.14.6

3.0.0 - 3.2.3

Fixed in 3.2.4

3.3.0 - 3.3.0

Fixed in 3.3.1

3.4.0 - 3.4.1

Fixed in 3.4.2

Are you affected? Scan for Free

TL;DR

eProsima.Fast-DDS processes RTPS HEARTBEAT submessages on RELIABLE readers without bounding the first sequence number. A crafted HEARTBEAT with a huge firstSN stores that value as the writer low mark, then StatefulReader::NotifyChanges() loops from the last notified sequence up to that mark and runs a linear history lookup on every iteration. That unbounded loop can hang the subscriber until the process is killed. The fix marks all pending sequences as notified in constant time instead of iterating each missing number.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your participant uses RELIABLE QoS readers reachable on the DDS domain.

Background info

eProsima.Fast-DDS is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 2.6.10, 2.7.0 - 2.14.5, 3.0.0 - 3.2.3, 3.3.0 - 3.3.0 and 3.4.0 - 3.4.1.