rosbridge_library Protocol.incoming() quadratic CPU cost disclosed on oss-security; follow-ups flag uncoordinated disclosure

Evgenios Gkritsis publicly disclosed an algorithmic-complexity flaw (CWE-407/CWE-1050) in rosbridge_library's Protocol.incoming() JSON fallback that enables DoS via crafted messages; follow-up replies by Alan Coopersmith and David Wheeler added no technical…

On 2026-09-14, Evgenios Gkritsis disclosed on oss-security an algorithmic-complexity defect in rosbridge_suite's rosbridge_library, specifically in the Protocol.incoming() JSON fallback path. Crafted input can drive quadratic CPU cost and cause denial of service. The flaw is classified as CWE-407 (inefficient algorithmic complexity) and CWE-1050, exists on the current ros2 branch, was not removed by PR #1199, and has been present since the fallback was introduced. Two follow-up replies on oss-security added no technical detail: Alan Coopersmith (18:29 UTC) merely pointed to the public posting of the disclosure, and David A. Wheeler (19:53 UTC) observed that the flaw had just been publicly disclosed without prior coordination, referencing the mailing list's stated norms encouraging public discussion of open-source security flaws. As of the latest reply, no fix, CVE identifier, or exploitation details have been provided.

• Flaw: quadratic CPU cost in rosbridge_library's Protocol.incoming() JSON fallback path, enabling denial of service via crafted messages
• Classified as CWE-407 (inefficient algorithmic complexity) and CWE-1050
• Present on the current ros2 branch; not removed by PR #1199; present since the fallback was introduced
• Publicly disclosed by Evgenios Gkritsis on oss-security on 2026-09-14 (18:17 UTC)
• Alan Coopersmith's follow-up reply (18:29 UTC) only linked the original disclosure, adding no technical detail
• David A. Wheeler's follow-up reply (19:53 UTC) noted the flaw was publicly disclosed without prior coordination and cited oss-security norms; it contained no fix, CVE, or exploitation details
• No CVE identifier, patch, or fix has been mentioned in any of the reports