v2.6.12
Fast DDS v2.6.12
This release includes the following CVE fixes, bugfixes, improvements and CI improvements.
Security fixes (CVEs)
- CVE-2026-22590
- CVE-2026-22591
- CVE-2026-45094
- CVE-2026-45095
- CVE-2026-45096
- CVE-2025-63829
- CVE-2025-65865
- CVE-2026-45093
- CVE-2026-45092
- CVE-2025-67108
- CVE-2026-49861
- CVE-2026-53589
- CVE-2026-45098
- CVE-2026-49862
- CVE-2026-55063
- CVE-2026-49863
- CVE-2026-53588
- CVE-2026-53590
These CVEs were addressed in several squashed commits applied directly from privately reviewed branches (no public PR):
- Fix CVE-2026-22590 (CVE-2026-22590)
- Fix CVE-2026-22591 (CVE-2026-22591)
- Fix CVEs in Access Control parser (CVE-2026-45094, CVE-2026-45095, CVE-2026-45096)
- Fix several CVEs (CVE-2025-63829, CVE-2025-65865, CVE-2026-45093, CVE-2026-45092)
- Fix CVE-2025-67108 (CVE-2025-67108)
- Fix several deserialization CVEs (CVE-2026-49861, CVE-2026-53589, CVE-2026-45098, CVE-2026-49862, CVE-2026-55063, CVE-2026-49863, CVE-2026-53588, CVE-2026-53590)
Fixes
- Several fixes in TopicPayloadPool (#6464)
- Fix lock order inversion in StatefulWriter (#6463)
- Fix StatefulReader iterator invalidation during listener callback (#6473)
- Check endianness of TCPControlMsgHeader & TCPHeader (#2776)
CI improvements
- Upgrade Linters CI runner image to
ubuntu-24.04(#6253)