CVE-2023-39949

    Dashboard / Vulnerabilities / CVE-2023-39949

    CVE-2023-39949

    Published: 11 Aug 2023Last Modified: 12 Aug 2026

    Summary: Improper validation of sequence numbers leading to remotely reachable assertion failure

    Details: eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.9.1 and 2.6.5, improper validation of sequence numbers may lead to remotely reachable assertion failure. This can remotely crash any Fast-DDS process. Versions 2.9.1 and 2.6.5 contain a patch for this issue.

    References: https://github.com/eProsima/Fast-DDS/blob/v2.9.0/src/cpp/rtps/messages/MessageReceiver.cpp#L1059, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39949.json, https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-3jv9-j9x3-95cg, https://nvd.nist.gov/vuln/detail/CVE-2023-39949, https://www.debian.org/security/2023/dsa-5481, https://github.com/eProsima/Fast-DDS/issues/3236

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 7124ff87c4813bed26858fd89d3b915a5857dbc7
    Fixed -8f2a8828dcffab1e78f14023cdae7a8efe4e4a5b

    Affected versions

    2.9.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-39949 | CVE-DB