Skip to content
OpenAdvisories
Low · 1.7 CVE-2025-64438 EUVD-2025-206668

Fast-DDS: Unbounded GAP range triggers OOM DoS under RELIABLE QoS

Published Feb 3, 2026 · Updated Feb 3, 2026 · Assigned by GitHub_M

Description

Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group
). Prior to versions 3.4.1, 3.3.1, and 2.6.11, a remotely triggerable Out-of-Memory (OOM) denial-of-service exists in Fast
-DDS when processing RTPS GAP submessages under RELIABLE QoS. By sending a tiny GAP packet with a huge gap range (`gapList
.base - gapStart`), an attacker drives `StatefulReader::processGapMsg()` into an unbounded loop that inserts millions of s
equence numbers into `WriterProxy::changes_received_` (`std::set`), causing multi-GB heap growth and process termination.
No authentication is required beyond network reachability to the reader on the DDS domain. In environments without an RSS
limit (non-ASan / unlimited), memory consumption was observed to rise to ~64 GB. Versions 3.4.1, 3.3.1, and 2.6.11 patch t
he issue.

Affected products

VendorProductAffectedFixed
eProsima Fast-DDS 3.4.0 – < 3.4.1, 3.0.0 – < 3.3.1, < 2.6.11 3.4.1

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 13 fastdds No fix yet —
Debian 12 fastdds No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 fastdds No fix yet —
Ubuntu 26.04 LTS fastdds No fix yet —
Ubuntu 25.10 fastdds No fix yet —
Ubuntu 24.04 LTS fastdds No fix yet —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS fastdds No fix yet —

References