v3.2.5

Fast DDS v3.2.5

This release includes the following CVE fixes, bugfixes, improvements and CI improvements.

Security fixes (CVEs)

• CVE-2025-63829
• CVE-2025-65865
• CVE-2025-67108
• CVE-2026-22591
• CVE-2026-45092
• CVE-2026-45093
• CVE-2026-45094
• CVE-2026-45095
• CVE-2026-45096
• CVE-2026-45097
• CVE-2026-45098
• CVE-2026-49861
• CVE-2026-49862
• CVE-2026-49863
• CVE-2026-53588
• CVE-2026-53589
• CVE-2026-53590
• CVE-2026-55063

These CVEs were addressed in squashed commits applied directly from privately reviewed branches (no public PR):

• Fix several deserialization CVEs (CVE-2026-49861, CVE-2026-53589, CVE-2026-45098, CVE-2026-49862, CVE-2026-55063, CVE-2026-53588, CVE-2026-53590)
• Fix CVE-2025-67108 (CVE-2025-67108)
• Fix several CVEs (CVE-2025-63829, CVE-2025-65865, CVE-2026-45093, CVE-2026-45092, CVE-2026-45097)
• Fix CVEs in Access Control parser (CVE-2026-45094, CVE-2026-45095, CVE-2026-45096)
• Fix CVE-2026-22591 (CVE-2026-22591)

Fixes

• Fix RTPSParticipantAttributes internal data races (#6388)
• Catch exception when constructing a payload pool Node (#6461)
• Fix null-dereference build (#6398)
• Implement payload release in move assignment (#6469)
• Make on_xxx_matched thread-safe (#6381)
• Fix dereference error of 'shared_secret_handle' (#6406)
• Assert liveliness with periodic heartbeats in secure participants (#6413)
• Fix data races on DataWriterImpl qos access (#6423)
• Remove stale TCP channels (#6458)

Improvements

• Update RELEASE_SUPPORT.md to only have link to master version (#6431)
• Fix several warnings on several GCC versions (#6465)
• Update types with Fast DDS Gen v4.0.7 (#6479)

CI improvements

• Make skip-ci label report required statuses as pass (#6443)
• Improve windows tests (#6376)
• Update security tests to use governance-based encryption configuration (#6395)
• Add UBSan workflow and solve its errors (#6416)

---

PRs (merge order): #6388, #6431, #6443, #6461, #6376, #6465, #6398, #6469, #6395, #6381, #6406, #6416, #6413, #6423, #6458, #6479, #6482