en
eProsima is a middleware vendor focused on real-time publish/subscribe data distribution using DDS. It develops and maintains the Fast DDS library and related tools, with a global footprint in the distributed systems and robotics communities.
As of 09/14/2026, eProsima recorded 2 security vulnerabilities in the last 90 days across 1 products, including 2 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, Fast-DDS had the most security vulnerabilities in the eProsima ecosystem, with 2 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-22591Fast DDS DDSSQLFilter Recursive Parser Stack Exhaustion (Remote DoS) | Exploitation statusNot confirmed | FixNot confirmed | Affected productFast-DDS | Published09/09/2026 | SeverityHigh |
CVE-2026-22590Fast-DDS Discovery Server: Out-of-Bounds Read & Heap Memory Disclosure via DATA_FRAG sampleSize / fragmentsInSubmessage | Exploitation statusPublic exploit | FixNot confirmed | Affected productFast-DDS | Published09/09/2026 | SeverityCritical |
CVE-2025-64438Fast-DDS: Unbounded GAP range triggers OOM DoS under RELIABLE QoS | Exploitation statusNot known exploited | FixYes | Affected productFast-DDS | Published02/03/2026 | SeverityLow |
CVE-2025-64098FastDDS has Out-of-memory in readOctetVector via Manipulated DATA Submessage when DDS Security is enabled | Exploitation statusNot known exploited | FixYes | Affected productFast-DDS | Published02/03/2026 | SeverityLow |
CVE-2025-62799FastDDS's heap buffer overflow in RTPS DATA_FRAG enables unauthenticated DoS (potential RCE) | Exploitation statusNot known exploited | FixYes | Affected productFast-DDS | Published02/03/2026 | SeverityHigh |
CVE-2025-62603FastDDS has Out-of-memory while parsing GenericMessage when DDS Security is enabled | Exploitation statusNot known exploited | FixYes | Affected productFast-DDS | Published02/03/2026 | SeverityLow |
CVE-2025-62602FastDDS has heap buffer overflow in readData via Manipulated DATA Submessage when DDS Security is enabled | Exploitation statusNot known exploited | FixYes | Affected productFast-DDS | Published02/03/2026 | SeverityLow |
CVE-2025-62601FastDDS has heap buffer overflow in readString via Manipulated DATA Submessage when DDS Security is enabled | Exploitation statusNot known exploited | FixYes | Affected productFast-DDS | Published02/03/2026 | SeverityLow |
CVE-2025-62600eprosima Fast DDS affected by Out-of-Memory in readBinaryPropertySeq via Manipulated DATA Submessage when DDS Security is enabled | Exploitation statusPublic exploit | FixYes | Affected productFast-DDS | Published02/03/2026 | SeverityHigh |
CVE-2025-62599eprosima Fast DDS affected by Out-of-Memory in readPropertySeq via Manipulated DATA Submessage when DDS Security is enabled | Exploitation statusNot known exploited | FixYes | Affected productFast-DDS | Published02/03/2026 | SeverityHigh |
CVE-2025-65865 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published12/23/2025 | SeverityHigh |
CVE-2025-67108 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published12/23/2025 | SeverityCritical |
CVE-2025-63829 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published11/18/2025 | SeverityMedium |
CVE-2025-24807Fast DDS does not verify Permissions CA | Exploitation statusNot known exploited | FixNot confirmed | Affected productFast-DDS | Published02/11/2025 | SeverityMedium |
CVE-2023-24010Data Distribution Service (DDS) Chain of Trust (CoT) violation in Fast DDS | Exploitation statusPublic exploit | FixYes | Affected productDDS | Published01/09/2025 | SeverityHigh |
CVE-2024-30259FastDDS heap buffer overflow when publisher sends malformed packet | Exploitation statusPublic exploit | FixNot confirmed | Affected productFast-DDS | Published05/13/2024 | SeverityHigh |
CVE-2024-30258FastDDS crash when publisher send malformed packet | Exploitation statusPublic exploit | FixNot confirmed | Affected productFast-DDS | Published05/13/2024 | SeverityHigh |
CVE-2024-30916 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published04/11/2024 | SeverityMedium |
CVE-2024-30917 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published04/11/2024 | SeverityMedium |
CVE-2024-28231Manipulated DATA Submessage causes a heap-buffer-overflow error | Exploitation statusPublic exploit | FixNot confirmed | Affected productFast-DDS | Published03/20/2024 | SeverityCritical |
CVE-2023-50716Invalid DATA_FRAG Submessage causes a bad-free error | Exploitation statusNot known exploited | FixNot confirmed | Affected productFast-DDS | Published03/06/2024 | SeverityCritical |
CVE-2023-50257Disconnect Vulnerability in RTPS Packets Used by SROS2 | Exploitation statusPublic exploit | FixNot confirmed | Affected productFast-DDS | Published02/19/2024 | SeverityCritical |
CVE-2023-42459Malformed DATA submessage leads to bad-free error in Fast-DDS | Exploitation statusNot known exploited | FixNot confirmed | Affected productFast-DDS | Published10/16/2023 | SeverityHigh |
CVE-2023-39949Improper validation of sequence numbers leading to remotely reachable assertion failure | Exploitation statusPublic exploit | FixNot confirmed | Affected productFast-DDS | Published08/11/2023 | SeverityHigh |
CVE-2023-39948Uncaught fastcdr exception (Unexpected CDR type received) crashing fastdds | Exploitation statusPublic exploit | FixNot confirmed | Affected productFast-DDS | Published08/11/2023 | SeverityHigh |
CVE-2023-39947Another heap overflow in push_back_helper | Exploitation statusPublic exploit | FixNot confirmed | Affected productFast-DDS | Published08/11/2023 | SeverityHigh |
CVE-2023-39946Heap overflow in push_back_helper due to a CDR message | Exploitation statusPublic exploit | FixNot confirmed | Affected productFast-DDS | Published08/11/2023 | SeverityHigh |
CVE-2023-39945Malformed serialized data in a data submessage leads to unhandled exception | Exploitation statusPublic exploit | FixNot confirmed | Affected productFast-DDS | Published08/11/2023 | SeverityHigh |
CVE-2023-39534Malformed GAP submessage triggers assertion failure | Exploitation statusPublic exploit | FixNot confirmed | Affected productFast-DDS | Published08/11/2023 | SeverityHigh |
CVE-2021-38425eProsima Fast DDS Network Amplification | Exploitation statusNot known exploited | FixYes | Affected productFast DDS | Published05/05/2022 | SeverityHigh |
CVE-2019-15137 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/18/2019 | SeverityUnknown |
CVE-2019-15136 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/18/2019 | SeverityUnknown |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
