CVE-2026-22591

CVE-2026-22591 is a denial-of-service flaw in the SQL-based content-filtering component (DDSSQLFilter) of eProsima Fast DDS, a C++ implementation of the OMG DDS publish-subscribe standard. A single crafted SEDP DATA submessage carrying a PID_CONTENT_FILTER_PROPERTY with a deeply nested filter expression is enough to trigger uncontrolled recursion and resource exhaustion (CWE-400, CWE-674) and crash the receiving Fast DDS participant. Any participant in the same DDS domain can send this discovery traffic without authentication, so an attacker gains the ability to remotely crash peers; the impact is availability only, with no confidentiality or integrity effect per the CVSS vector. Anyone running Fast DDS before versions 2.6.12, 2.14.6, 3.2.4, or 3.4.3 is affected, including ROS 2 applications using the default Fast DDS middleware (rmw_fastrtps). No public proof-of-concept is known, the flaw is not in CISA KEV, and there are no reports of exploitation in the wild.

What to do: Upgrade Fast DDS to 2.6.12, 2.14.6, 3.2.4, or 3.4.3 depending on the branch you run; ROS 2 users should verify which Fast DDS (rmw_fastrtps) build ships with their distribution and rebuild against a fixed release. Until patched, restrict DDS discovery traffic (SPDP/SEDP, default UDP ports 7400-7410) to trusted peers via network segmentation, firewalls, or the DDS Security plugins, and investigate unexplained participant crashes. No public PoC or in-the-wild exploitation is currently known.