Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitylow

rosbridge_library Protocol.incoming() quadratic CPU cost disclosed on oss-security; follow-ups flag uncoordinated disclosure

1 source · 2 articlesFirst reported Updated ()3 · 1 read
What's new

Since the previous summary (written 2026-09-14T18:37Z, covering the original disclosure and Alan Coopersmith's reply), a new oss-security reply from David A. Wheeler (2026-09-14T19:53Z) observed that the rosbridge_library flaw had been publicly disclosed without prior coordination, referencing the mailing list's norms encouraging public discussion of open-source security flaws. Wheeler's reply…

Merged summary · glm-5.3 · rewritten as coverage arrivesSummaries by Vani AI

Evgenios Gkritsis publicly disclosed an algorithmic-complexity flaw (CWE-407/CWE-1050) in rosbridge_library's Protocol.incoming() JSON fallback that enables DoS via crafted messages; follow-up replies by Alan Coopersmith and David Wheeler added no technical…

On 2026-09-14, Evgenios Gkritsis disclosed on oss-security an algorithmic-complexity defect in rosbridge_suite's rosbridge_library, specifically in the Protocol.incoming() JSON fallback path. Crafted input can drive quadratic CPU cost and cause denial of service. The flaw is classified as CWE-407 (inefficient algorithmic complexity) and CWE-1050, exists on the current ros2 branch, was not removed by PR #1199, and has been present since the fallback was introduced. Two follow-up replies on oss-security added no technical detail: Alan Coopersmith (18:29 UTC) merely pointed to the public posting of the disclosure, and David A. Wheeler (19:53 UTC) observed that the flaw had just been publicly disclosed without prior coordination, referencing the mailing list's stated norms encouraging public discussion of open-source security flaws. As of the latest reply, no fix, CVE identifier, or exploitation details have been provided.

Key facts
  • Flaw: quadratic CPU cost in rosbridge_library's Protocol.incoming() JSON fallback path, enabling denial of service via crafted messages
  • Classified as CWE-407 (inefficient algorithmic complexity) and CWE-1050
  • Present on the current ros2 branch; not removed by PR #1199; present since the fallback was introduced
  • Publicly disclosed by Evgenios Gkritsis on oss-security on 2026-09-14 (18:17 UTC)
  • Alan Coopersmith's follow-up reply (18:29 UTC) only linked the original disclosure, adding no technical detail
  • David A. Wheeler's follow-up reply (19:53 UTC) noted the flaw was publicly disclosed without prior coordination and cited oss-security norms; it contained no fix, CVE, or exploitation details
  • No CVE identifier, patch, or fix has been mentioned in any of the reports
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Coverage

oldest first · one row per article · UTC
  1. · Sep 14, 2026 oss-securityFirst report

    rosbridge_library Protocol.incoming() quadratic CPU cost in JSON fallback

    rosbridge_library's Protocol.incoming() has quadratic CPU cost in its JSON fallback, enabling denial of service via crafted messages.

  2. · Sep 14, 2026 oss-security

    Re: rosbridge_library Protocol.incoming() quadratic CPU cost in JSON fallback

    Alan Coopersmith's mailing list reply merely points to the public oss-security posting of the rosbridge_library disclosure.