CVE-2025-62603: Fast DDS DoS Vulnerability

CVE-2025-62603 Overview

CVE-2025-62603 is a memory exhaustion vulnerability in Fast DDS, a C++ implementation of the Data Distribution Service (DDS) standard by the Object Management Group (OMG). The vulnerability exists in the ParticipantGenericMessage parsing mechanism, which handles DDS Security control-message containers used for handshakes, crypto-token exchange, rekeying, re-authentication, and token delivery for newly appearing endpoints.

The CDR parser deserializes the message_data (the DataHolderSeq) via the readParticipantGenericMessage → readDataHolderSeq path without implementing minimal header inspection. This allows remote attackers to craft malicious RTPS messages that trigger excessive memory allocation, leading to an out-of-memory condition and process termination.

Critical Impact

Remote attackers can terminate Fast DDS processes by sending specially crafted RTPS messages that exploit the exhaustive parsing behavior of the CDR parser, causing denial of service in DDS-based systems.

Affected Products

• Fast DDS versions prior to 3.4.1
• Fast DDS versions prior to 3.3.1
• Fast DDS versions prior to 2.6.11

Discovery Timeline

• 2026-02-03 - CVE CVE-2025-62603 published to NVD
• 2026-02-04 - Last updated in NVD database

Technical Details for CVE-2025-62603

Vulnerability Analysis

The vulnerability stems from the stateless nature of the CDR parser when processing ParticipantGenericMessage structures. When the parser receives incoming messages, it fully deserializes the entire DataHolderSeq structure before any higher-layer validation occurs. The DataHolderSeq is parsed sequentially, processing a sequence count (uint32), followed by each DataHolder containing the class_id string (e.g., DDS:Auth:PKI-DH:1.0+Req), string properties (key/value pairs), and binary properties (name plus octet-vector).

Because RTPS (Real-Time Publish Subscribe) protocol permits duplicates, delays, and retransmissions, receivers must perform structural parsing to verify identity and sequence numbers. However, the vulnerable implementation does not implement a "peek" mechanism to inspect only minimal header information before committing to full parsing. This design flaw allows attackers to send malformed messages with large sequence counts or oversized data structures that consume excessive memory during parsing.

The CWE-125 (Out-of-bounds Read) classification indicates that the parser may also read beyond allocated buffer boundaries when processing malformed message structures, compounding the memory safety issues.

Root Cause

The root cause is the lack of resource limits and minimal header validation in the CDR parser's readDataHolderSeq function. The parser operates statelessly and fully unfolds incoming message structures before distinguishing legitimate traffic from malformed or malicious packets. This design assumes well-formed input and does not implement defensive parsing techniques such as:

• Pre-validation of sequence counts against reasonable limits
• Incremental parsing with memory allocation caps
• Header-only inspection to validate message identity before full deserialization

Attack Vector

This vulnerability is exploitable over the network without authentication. An attacker can send specially crafted RTPS messages to a Fast DDS participant containing:

1. A ParticipantGenericMessage with an extremely large DataHolderSeq sequence count
2. Malformed DataHolder entries with oversized string properties or binary properties
3. Nested structures designed to maximize memory allocation during parsing

The parser will attempt to allocate memory for all declared elements before any validation occurs, allowing attackers to exhaust available memory and crash the target process.

Since no verified code examples are available for this vulnerability, the attack mechanism involves sending crafted RTPS packets to the DDS Security message endpoint. Attackers would construct malformed ParticipantGenericMessage payloads with exaggerated sequence counts or deeply nested structures that force the CDR parser to allocate excessive memory. For detailed technical analysis, refer to the GitHub security commits.

Detection Methods for CVE-2025-62603

Indicators of Compromise

• Unexpected process termination of Fast DDS applications with out-of-memory errors
• Abnormal memory consumption spikes in DDS-enabled services
• RTPS traffic containing unusually large ParticipantGenericMessage payloads
• Repeated connection attempts from unknown sources to DDS Security endpoints

Detection Strategies

• Monitor system memory utilization for Fast DDS processes and alert on rapid consumption patterns
• Implement network traffic analysis to detect RTPS messages with anomalously large DataHolderSeq counts
• Deploy application-level logging to track CDR parsing operations and identify parsing failures
• Use SentinelOne's behavioral AI to detect process crashes correlated with network activity

Monitoring Recommendations

• Enable process monitoring for Fast DDS applications to detect unexpected terminations
• Configure memory usage thresholds and alerts for DDS service processes
• Implement RTPS traffic inspection at network boundaries to identify malformed security messages
• Review Fast DDS application logs for repeated parsing errors or memory allocation failures

How to Mitigate CVE-2025-62603

Immediate Actions Required

• Upgrade Fast DDS to version 3.4.1, 3.3.1, or 2.6.11 depending on your release branch
• Review and restrict network access to DDS participants to trusted sources only
• Implement network segmentation to limit exposure of DDS services
• Monitor affected systems for signs of exploitation while patches are being deployed

Patch Information

eProsima has released patches addressing this vulnerability across multiple release branches. The fixes implement proper bounds checking and resource limits in the CDR parser to prevent memory exhaustion attacks.

• Version 3.4.1: Patch commit 354218514d32beac963ff5c306f1cf159ee37c5f
• Version 3.3.1: Patch commit a726e6a5daba660418d1f7c05b6f203c17747d2b
• Version 2.6.11: Patch commit ced3b6f92d928af1eae77d5fe889878128ad421a

Additional tracking information is available via the Debian CVE Tracker.

Workarounds

• Restrict network access to DDS participants using firewall rules to allow only trusted peers
• Implement rate limiting on RTPS traffic at the network level to mitigate resource exhaustion attempts
• Deploy DDS applications in isolated network segments with strict ingress filtering
• Consider implementing application-level message size limits if supported by your deployment configuration

# Example: Restrict DDS traffic to trusted network ranges using iptables
# Adjust port and IP ranges according to your DDS deployment
iptables -A INPUT -p udp --dport 7400:7900 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p udp --dport 7400:7900 -j DROP