High severity · published Sep 9, 2026
CVE-2026-22591
Fast DDS DDSSQLFilter Recursive Parser Stack Exhaustion (Remote DoS)
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to versions 2.6.12, 2.14.6, 3.2.4, and 3.4.3, Fast DDS’s implementation of SQL‑based content filtering (DDSSQLFilter) allows any participant in a DDS domain to remotely crash other Fast DDS participants by sending a single crafted SEDP `DATA` submessage whose `PID_CONTENT_FILTER_PROPERTY.filterExpression` contains a deeply nested filter expression. Versions 2.6.12, 2.14.6, 3.2.4, and 3.4.3 fix the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FA
Fast-DDS · eProsima
< 2.6.12; >= 2.7.0, < 2.14.6; >= 3.0.0, < 3.2.4; >= 3.4.0, < 3.4.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-22591
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-22591
github.com
https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-7577-rf2r-j88m
More from Fast-DDS
10.0
CVE-2025-67108
eProsima Fast-DDS v3.3 was discovered to contain improper validation for ticket revocation, resulting in insecure communications and connections
9.8
CVE-2025-62799
FastDDS's heap buffer overflow in RTPS DATA_FRAG enables unauthenticated DoS (potential RCE)
9.8
CVE-2023-50716
eProsima Fast DDS (formerly Fast RTPS) is a C++ implementation of the Data Distribution Service standard of the Object Management Group
9.1
CVE-2026-22590
Fast-DDS Discovery Server: Out-of-Bounds Read & Heap Memory Disclosure via DATA_FRAG sampleSize / fragmentsInSubmessage
9.1
CVE-2021-38425
eProsima Fast DDS versions prior to 2.4.0 (#2269) are susceptible to exploitation when an attacker sends a specially crafted packet to flood a target device with unwanted traffic,…