Eclipse Cyclonedds vulnerabilities

2 CVEs affecting Eclipse Cyclonedds, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-38443, published 2022-05-05.

More from Eclipse.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2021-38441, published 2022-05-05. Critical severity, CVSS 9.8. EPSS: 2.1% chance of exploitation in the next 30 days. Eclipse CycloneDDS versions prior to 0.8.0 are vulnerable to a write-what-where condition, which may allow an attacker to write arbitrary values in the XML parser.
• CVE-2021-38443, published 2022-05-05. Critical severity, CVSS 9.8. EPSS: 2.1% chance of exploitation in the next 30 days. Eclipse CycloneDDS versions prior to 0.8.0 improperly handle invalid structures, which may allow an attacker to write arbitrary values in the XML parser.