Catalogo CVE

CVE-2024-30259

fastdds affected and fixed versions

FastDDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to versions 2.14.1, 2.13.5, 2.10.4, and 2.6.8, when a publisher serves malformed `RTPS` packet, heap buffer overflow occurs on the subscriber. This can remotely crash any Fast-DDS process, potentially leading to a DOS attack. Versions 2.14.1, 2.13.5, 2.10.4, and 2.6.8 contain a patch for the issue.

Gravità: Medium
Published: May 14, 2024, 3:22:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.87% · Oct 27, 2026

Projects and upstream resources

[fastdds][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiantrixie	fastdds	`2.14.1+ds-1`	FixedDistribution-reported fixed boundary	[CVE-2024-30259]
Debiantrixie	fastdds	`3.1.2+ds-1`	Fixed	[CVE-2024-30259]
Debiansid	fastdds	`2.14.1+ds-1`	FixedDistribution-reported fixed boundary	[CVE-2024-30259]
Debiansid	fastdds	`3.3.0+ds-3`	Fixed	[CVE-2024-30259]

Showing 4 fix observations. All 17 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
UnknownRelease not reported	fastdds	Not reported	UnknownSource applicability is not established	Provider not reported
Debianbookworm	fastdds	Not reported	AffectedDistribution reports no fix	[CVE-2024-30259]
Debianbookworm	fastdds	`2.9.1+ds-1+deb12u2`	Affected	[CVE-2024-30259]
Debianbookworm-security	fastdds	`2.9.1+ds-1+deb12u2`	Affected	[CVE-2024-30259]
Debiansid	fastdds	`2.14.1+ds-1`	FixedDistribution-reported fixed boundary	[CVE-2024-30259]
Debiansid	fastdds	`3.3.0+ds-3`	Fixed	[CVE-2024-30259]
Debiantrixie	fastdds	`2.14.1+ds-1`	FixedDistribution-reported fixed boundary	[CVE-2024-30259]
Debiantrixie	fastdds	`3.1.2+ds-1`	Fixed	[CVE-2024-30259]
Ubuntu24.04	fastdds	`2.10.1+ds-3`	Affected	[UBUNTU-CVE-2024-30259]Apr 22, 2026, 2:48:08 PM UTC
Ubuntu24.04	fastdds	`2.11.2+ds-6`	Affected	[UBUNTU-CVE-2024-30259]Apr 22, 2026, 2:48:08 PM UTC
Ubuntu24.04	fastdds	`2.11.2+ds-6.1build2`	Affected	[UBUNTU-CVE-2024-30259]Apr 22, 2026, 2:48:08 PM UTC
Ubuntu24.04	fastdds	`2.11.2+ds-6.1build3`	Affected	[UBUNTU-CVE-2024-30259]Apr 22, 2026, 2:48:08 PM UTC
Ubuntu24.04	fastdds	`2.11.2+ds-6ubuntu1`	Affected	[UBUNTU-CVE-2024-30259]Apr 22, 2026, 2:48:08 PM UTC
Ubuntupro	fastdds	`2.1.0+ds-9`	Affected	[UBUNTU-CVE-2024-30259]Apr 22, 2026, 2:48:08 PM UTC
Ubuntupro	fastdds	`2.4.1+ds-1`	Affected	[UBUNTU-CVE-2024-30259]Apr 22, 2026, 2:48:08 PM UTC
Ubuntupro	fastdds	`2.5.0+ds-3`	Affected	[UBUNTU-CVE-2024-30259]Apr 22, 2026, 2:48:08 PM UTC
Ubuntupro	fastdds	`2.5.0+ds-3ubuntu0.1~esm1`	Affected	[UBUNTU-CVE-2024-30259]Apr 22, 2026, 2:48:08 PM UTC

Original provider fields

{
  "package_releases": [
    {
      "name": "fastdds",
      "status": "fixed",
      "release": "sid",
      "version": "3.3.0+ds-3"
    },
    {
      "name": "fastdds",
      "status": "fixed",
      "release": "trixie",
      "version": "3.1.2+ds-1"
    },
    {
      "name": "fastdds",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "2.9.1+ds-1+deb12u2"
    },
    {
      "name": "fastdds",
      "status": "vulnerable",
      "release": "bookworm-security",
      "version": "2.9.1+ds-1+deb12u2"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "fastdds",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "2.14.1+ds-1"
    },
    {
      "bug": null,
      "name": "fastdds",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "2.14.1+ds-1"
    },
    {
      "bug": null,
      "name": "fastdds",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": ""
    }
  ],
  "distribution_packages": [
    {
      "name": "fastdds",
      "fixed_version": "not yet fixed",
      "applicability_unknown": true
    },
    {
      "name": "fastdds",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "2.1.0+ds-9",
        "2.4.1+ds-1",
        "2.5.0+ds-3",
        "2.5.0+ds-3ubuntu0.1~esm1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2024-30259",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2024-30259",
      "provider_updated_at": "2026-04-22T14:48:08.393597Z"
    },
    {
      "name": "fastdds",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "24.04",
      "versions": [
        "2.10.1+ds-3",
        "2.11.2+ds-6",
        "2.11.2+ds-6ubuntu1",
        "2.11.2+ds-6.1build2",
        "2.11.2+ds-6.1build3"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2024-30259",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2024-30259",
      "provider_updated_at": "2026-04-22T14:48:08.393597Z"
    }
  ]
}

Publisher notes

[bookworm] fastdds: Minor issue

OpenFactory catalog packages

L’associazione dei pacchetti è in corso.

[Debian 12 (Bookworm)]

[fastdds-tools]Sconosciuto
Pacchetto sorgente: [fastdds]
Dettagli (4)
- 2.9.1+ds-1+deb12u2 · amd64 · bookworm
  Interessata
  dsa · fastdds · debian · bookworm; dsa · fastdds · debian · 12
- 2.9.1+ds-1+deb12u2 · arm64 · bookworm
  Interessata
  dsa · fastdds · debian · bookworm; dsa · fastdds · debian · 12
- 2.9.1+ds-1+deb12u2 · amd64 · bookworm-security
  Interessata
  dsa · fastdds · debian · bookworm; dsa · fastdds · debian · 12
- 2.9.1+ds-1+deb12u2 · arm64 · bookworm-security
  Interessata
  dsa · fastdds · debian · bookworm; dsa · fastdds · debian · 12
[libfastrtps2.9]Sconosciuto
Pacchetto sorgente: [fastdds]
Dettagli (4)
- 2.9.1+ds-1+deb12u2 · amd64 · bookworm
  Interessata
  dsa · fastdds · debian · bookworm; dsa · fastdds · debian · 12
- 2.9.1+ds-1+deb12u2 · arm64 · bookworm
  Interessata
  dsa · fastdds · debian · bookworm; dsa · fastdds · debian · 12
- 2.9.1+ds-1+deb12u2 · amd64 · bookworm-security
  Interessata
  dsa · fastdds · debian · bookworm; dsa · fastdds · debian · 12
- 2.9.1+ds-1+deb12u2 · arm64 · bookworm-security
  Interessata
  dsa · fastdds · debian · bookworm; dsa · fastdds · debian · 12
[libfastrtps-dev]Sconosciuto
Pacchetto sorgente: [fastdds]
Dettagli (4)
- 2.9.1+ds-1+deb12u2 · amd64 · bookworm
  Interessata
  dsa · fastdds · debian · bookworm; dsa · fastdds · debian · 12
- 2.9.1+ds-1+deb12u2 · arm64 · bookworm
  Interessata
  dsa · fastdds · debian · bookworm; dsa · fastdds · debian · 12
- 2.9.1+ds-1+deb12u2 · amd64 · bookworm-security
  Interessata
  dsa · fastdds · debian · bookworm; dsa · fastdds · debian · 12
- 2.9.1+ds-1+deb12u2 · arm64 · bookworm-security
  Interessata
  dsa · fastdds · debian · bookworm; dsa · fastdds · debian · 12
[libfastrtps-doc]Sconosciuto
Pacchetto sorgente: [fastdds]
Dettagli (4)
- 2.9.1+ds-1+deb12u2 · all · bookworm
  Interessata
  dsa · fastdds · debian · bookworm; dsa · fastdds · debian · 12
- 2.9.1+ds-1+deb12u2 · all · bookworm
  Interessata
  dsa · fastdds · debian · bookworm; dsa · fastdds · debian · 12
- 2.9.1+ds-1+deb12u2 · all · bookworm-security
  Interessata
  dsa · fastdds · debian · bookworm; dsa · fastdds · debian · 12
- 2.9.1+ds-1+deb12u2 · all · bookworm-security
  Interessata
  dsa · fastdds · debian · bookworm; dsa · fastdds · debian · 12

[Debian 13 (Trixie)]

[fastdds-tools]Sconosciuto
Pacchetto sorgente: [fastdds]
Dettagli (2)
- 3.1.2+ds-1+b1 · amd64 · trixie
  Corretta · Corretta: 2.14.1+ds-1
  dsa · fastdds · debian · 13
- 3.1.2+ds-1+b1 · arm64 · trixie
  Corretta · Corretta: 2.14.1+ds-1
  dsa · fastdds · debian · 13
[libfastdds3.1]Sconosciuto
Pacchetto sorgente: [fastdds]
Dettagli (2)
- 3.1.2+ds-1+b1 · amd64 · trixie
  Corretta · Corretta: 2.14.1+ds-1
  dsa · fastdds · debian · 13
- 3.1.2+ds-1+b1 · arm64 · trixie
  Corretta · Corretta: 2.14.1+ds-1
  dsa · fastdds · debian · 13
[libfastdds-dev]Sconosciuto
Pacchetto sorgente: [fastdds]
Dettagli (2)
- 3.1.2+ds-1+b1 · amd64 · trixie
  Corretta · Corretta: 2.14.1+ds-1
  dsa · fastdds · debian · 13
- 3.1.2+ds-1+b1 · arm64 · trixie
  Corretta · Corretta: 2.14.1+ds-1
  dsa · fastdds · debian · 13
[libfastdds-doc]Sconosciuto
Pacchetto sorgente: [fastdds]
Dettagli (2)
- 3.1.2+ds-1 · all · trixie
  Corretta · Corretta: 2.14.1+ds-1
  dsa · fastdds · debian · 13
- 3.1.2+ds-1 · all · trixie
  Corretta · Corretta: 2.14.1+ds-1
  dsa · fastdds · debian · 13
[libfastrtps-dev]Sconosciuto
Pacchetto sorgente: [fastdds]
Dettagli (2)
- 3.1.2+ds-1 · all · trixie
  Corretta · Corretta: 2.14.1+ds-1
  dsa · fastdds · debian · 13
- 3.1.2+ds-1 · all · trixie
  Corretta · Corretta: 2.14.1+ds-1
  dsa · fastdds · debian · 13

Osservato: Oct 28, 2026, 4:50:25 PM UTC

Riferimenti

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]