What is CVE-2026-22591?

CVE-2026-22591 is a high-severity vulnerability in Eprosima Fast-Dds, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2026-09-09.

How severe is CVE-2026-22591?

High severity. CVSS v3 base score is 7.5 out of 10.

Resource exhaustion in Eprosima Fast-Dds

CVE-2026-22591

eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to versions 2.6.12, 2.14.6, 3.2.4, and 3.4.3, Fast DDS’s implementation of SQL‑based content filtering (DDSSQLFilter) allows any participant in a DDS domain to remotely crash other Fast DDS participants by sending a single crafted SEDP `DATA` submessage whose `PID_CONTENT_FILTER_PROPERTY.filterExpression` contains a deeply nested filter expression. Versions 2.6.12, 2.14.6, 3.2.4, and 3.4.3 fix the issue.

Vulnerability class: DoS (Denial of Service)

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Eprosima Fast-dds — versions < 2.6.12, >= 2.7.0, < 2.14.6, >= 3.0.0, < 3.2.4

Weakness classification (CWE)

References

security-advisories@github.com (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2026-22591?: CVE-2026-22591 is a high-severity vulnerability in Eprosima Fast-Dds, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2026-09-09.
How severe is CVE-2026-22591?: High severity. CVSS v3 base score is 7.5 out of 10.