CVE-2021-38425
eProsima Fast DDS Network Amplification
eProsima Fast DDS versions prior to 2.4.0 (#2269) are susceptible to exploitation when an attacker sends a specially crafted packet to flood a target device with unwanted traffic, which may result in a denial-of-service condition and information exposure.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
eProsima Fast DDS Network Amplification
eProsima Fast DDS versions prior to 2.4.0 (#2269) are susceptible to exploitation when an attacker sends a specially crafted packet to flood a target device with unwanted traffic, which may result in a denial-of-service condition and information exposure.
- Record
CVE-2021-38425- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-406
- Updated
- 2026-11-02
EUVDEUVD-2021-24877
eProsima Fast DDS versions prior to 2.4.0 (#2269) are susceptible to exploitation when an attacker sends a specially crafted packet to flood a target device with unwanted traffic, which may result in a denial-of-service condition and information exposure.
- Record
EUVD-2021-24877- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-6x94-8g2r-qg72
eProsima Fast DDS versions prior to 2.4.0 (#2269) are susceptible to exploitation when an...
eProsima Fast DDS versions prior to 2.4.0 (#2269) are susceptible to exploitation when an attacker sends a specially crafted packet to flood a target device with unwanted traffic, which may result in a denial-of-service condition and information exposure.
- Record
GHSA-6x94-8g2r-qg72- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Weakness
- CWE-406
- Updated
- 2026-11-02
NVD
eProsima Fast DDS versions prior to 2.4.0 (#2269) are susceptible to exploitation when an attacker sends a specially crafted packet to flood a target device with unwanted traffic, which may result in a denial-of-service condition and information exposure.
- Record
CVE-2021-38425- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:P - Weakness
- CWE-406
- Updated
- 2026-11-02
OSV
eProsima Fast DDS versions prior to 2.4.0 (#2269) are susceptible to exploitation when an attacker sends a specially crafted packet to flood a target device with unwanted traffic, which may result in a denial-of-service condition and information exposure.
- Record
CVE-2021-38425- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-38425
eProsima Fast DDS versions prior to 2.4.0 (#2269) are susceptible to exploitation when an attacker sends a specially crafted packet to flood a target device with unwanted traffic, which may result in a denial-of-service condition and information exposure.
- Record
DEBIAN-CVE-2021-38425- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-38425
eProsima Fast DDS versions prior to 2.4.0 (#2269) are susceptible to exploitation when an attacker sends a specially crafted packet to flood a target device with unwanted traffic, which may result in a denial-of-service condition and information exposure.
- Record
UBUNTU-CVE-2021-38425- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVUSN-6306-1 No score
fastdds vulnerabilities
It was discovered that Fast DDS incorrectly handled certain inputs. A remote attacker could possibly use this issue to cause a denial of service and information exposure. This issue only affected Ubuntu 22.04 LTS. (CVE-2021-38425)
It was discovered that Fast DDS incorrectly handled certain inputs. An attacker could possibly use this issue to cause a crash. (CVE-2023-39534, CVE-2023-39945, CVE-2023-39946, CVE-2023-39947, CVE-2023-39948, CVE-2023-39949)
- Record
USN-6306-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
fastddsDebian:12 |
before 2.6.1+ds-1 | 2.6.1+ds-1 |
fastddsDebian:13 |
before 2.6.1+ds-1 | 2.6.1+ds-1 |
fastddsUbuntu:Pro:22.04:LTS |
before 2.5.0+ds-3ubuntu0.1~esm1, plus listed versions 2.1.0+ds-92.4.1+ds-12.5.0+ds-3 |
2.5.0+ds-3ubuntu0.1~esm1 |
fastddsUbuntu:Pro:22.04:LTS From an advisory covering 7 CVEs |
before 2.5.0+ds-3ubuntu0.1~esm1, plus listed versions 2.1.0+ds-92.4.1+ds-12.5.0+ds-3 |
2.5.0+ds-3ubuntu0.1~esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-38425 is a high vulnerability (CVSS 7.5) in Eprosima Fast Dds, published May 5, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.02%, the 92nd percentile. Fixed in fastdds 2.6.1+ds-1.
References
cisa.gov/uscert/ics/advisories/icsa-21-315-02
github.com/eProsima/Fast-DDS
nvd.nist.gov/vuln/detail/CVE-2021-38425
security-tracker.debian.org/tracker/CVE-2021-38425
ubuntu.com/security/CVE-2021-38425
Show 10 moreShow less
cve.org/CVERecord?id=CVE-2021-38425