rosbridge_library Protocol.incoming() quadratic CPU cost in JSON fallback
rosbridge_library's Protocol.incoming() has quadratic CPU cost in its JSON fallback, enabling denial of service via crafted messages.
Evgenios Gkritsis disclosed an algorithmic-complexity defect in rosbridge_suite's rosbridge_library Protocol.incoming() JSON fallback path, classified as CWE-407/CWE-1050. The flaw exists in the current ros2 branch and was not removed by PR #1199, having been present since the fallback was introduced. Crafted input can drive quadratic CPU cost and cause denial of service.
25