Out-of-Memory Denial-of-Service in Fast DDS by eProsima

CVE-2025-64438

What is CVE-2025-64438?

Fast DDS, a C++ implementation of the DDS standard, is susceptible to a denial-of-service vulnerability that can be triggered remotely. Attackers can exploit this flaw by sending a specially crafted tiny GAP packet with an exaggerated gap range, leading to an unbounded loop that floods the memory with an enormous number of sequence numbers. This results in substantial memory consumption, reaching several gigabytes, which can cause the process to terminate unexpectedly. The vulnerability exists in versions prior to 3.4.1, 3.3.1, and 2.6.11, where no authentication is necessary, merely network access to the reader within the DDS domain. Upgrade to the latest versions to mitigate this security risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References