CVE-2025-64438 Fast-DDS: Unbounded GAP range triggers OOM DoS under RELIABLE QoS
Remote attackers can cause denial of service in Fast-DDS by sending crafted RTPS GAP packets, leading to unbounded memory consumption and process termination.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-64438?
CVE-2025-64438 is a low-severity denial of service vulnerability in eProsima Fast-DDS, published on 3 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group ). Prior to versions 3.4.1, 3.3.1, and 2.6.11, a remotely triggerable Out-of-Memory (OOM) denial-of-service exists in Fast -DDS when processing RTPS GAP submessages under RELIABLE QoS. By sending a tiny GAP packet with a huge gap range (`gapList .base - gapStart`), an attacker drives `StatefulReader::processGapMsg()` into an unbounded loop that inserts millions of s equence numbers into `WriterProxy::changes_received_` (`std::set`), causing multi-GB heap growth and process termination. No authentication is required beyond network reachability to the reader on the DDS domain. In environments without an RSS limit (non-ASan / unlimited), memory consumption was observed to rise to ~64 GB. Versions 3.4.1, 3.3.1, and 2.6.11 patch t he issue.
Weakness: CWE-835
Which versions are affected by CVE-2025-64438?
It affects 1 product.
Products include Eprosima Fast Dds.
How do I fix CVE-2025-64438?
No fix has been published for CVE-2025-64438 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-64438 being exploited?
There is no known exploitation of CVE-2025-64438 in the wild and no public exploit code.
Other vulnerabilities in eProsima Fast-DDS
- CVE-2025-67108 Security feature bypass in n/a
- CVE-2024-28231 Manipulated DATA Submessage causes a heap-buffer-overflow error
- CVE-2023-50716 Invalid DATA_FRAG Submessage causes a bad-free error
- CVE-2023-50257 Disconnect Vulnerability in RTPS Packets Used by SROS2
- CVE-2023-42459 Malformed DATA submessage leads to bad-free error in Fast-DDS
Sources
Also known as DEBIAN-CVE-2025-64438, UBUNTU-CVE-2025-64438.