SQL Content Filtering Flaw in eProsima Fast DDS
CVE-2026-22591

7.5HIGH

Key Information:

Vendor

Eprosima

Status
Fast-dds
Vendor
CVE Published:
9 September 2026

What is CVE-2026-22591?

eProsima Fast DDS has a vulnerability in its SQL-based content filtering implementation that allows any participant within a DDS domain to induce a crash in other participants. This is achieved by sending a specially crafted SEDP DATA submessage that includes a deeply nested filter expression in the PID_CONTENT_FILTER_PROPERTY.filterExpression. Users should update to versions 2.6.12, 2.14.6, 3.2.4, or 3.4.3 to mitigate this issue.

Affected Version(s)

Fast-DDS < 2.6.12 < 2.6.12

Fast-DDS >= 2.7.0, < 2.14.6 < 2.7.0, 2.14.6

Fast-DDS >= 3.0.0, < 3.2.4 < 3.0.0, 3.2.4

References

https://github.com/eProsima/Fast-DDS/security/advisories/...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.