Eclipse Cyclone Data Distribution Service vulnerabilities

4 CVEs affecting Eclipse Cyclone Data Distribution Service, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-67109, published 2025-12-23.

More from Eclipse.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2020-18735, published 2021-08-23. High severity, CVSS 7.5. EPSS: 1.9% chance of exploitation in the next 30 days. A heap buffer overflow in /src/dds_stream.c of Eclipse IOT Cyclone DDS Project v0.1.0 causes the DDS subscriber server to crash.
• CVE-2020-18734, published 2021-08-23. High severity, CVSS 7.5. EPSS: 1.9% chance of exploitation in the next 30 days. A stack buffer overflow in /ddsi/q_bitset.h of Eclipse IOT Cyclone DDS Project v0.1.0 causes the DDS subscriber server to crash.
• CVE-2024-10838, published 2025-03-12. Critical severity, CVSS 9.1. EPSS: 0.9% chance of exploitation in the next 30 days. An integer underflow during deserialization may allow any unauthenticated user to read out of bounds heap memory. This may result into secret data or pointers revealing the layout of the address…
• CVE-2025-67109, published 2025-12-23. Critical severity, CVSS 10.0. EPSS: 0.3% chance of exploitation in the next 30 days. Improper verification of the time certificate in Eclipse Cyclone DDS before v0.10.5 allows attackers to bypass certificate checks and execute commands with System privileges.