Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitylow

rosbridge_library Protocol.incoming() quadratic CPU cost in JSON fallback

oss-security ()2
Read at seclists.org
Part of a story covered by 2 sourcesrosbridge_library Protocol.incoming() quadratic CPU cost disclosed on oss-security; follow-ups flag uncoordinated disclosureMerged summary & timeline
AI summary · glm-5.3Summaries by Vani AI

rosbridge_library's Protocol.incoming() has quadratic CPU cost in its JSON fallback, enabling denial of service via crafted messages.

Evgenios Gkritsis disclosed an algorithmic-complexity defect in rosbridge_suite's rosbridge_library Protocol.incoming() JSON fallback path, classified as CWE-407/CWE-1050. The flaw exists in the current ros2 branch and was not removed by PR #1199, having been present since the fallback was introduced. Crafted input can drive quadratic CPU cost and cause denial of service.

Key facts
  • Quadratic CPU cost in Protocol.incoming() JSON fallback enables DoS
  • Present on current ros2 branch and not fixed by PR #1199
  • Classified as CWE-407 inefficient algorithmic complexity
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
algorithmic-complexitycwe-407denial-of-servicerosrosbridge

From the original article

Posted by Evgenios Gkritsis on Sep 14 Hello, I am reporting an algorithmic-complexity defect in rosbridge_library. protocol. Protocol.

oss-security

seclists.org

Read the full article at oss-security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.