Denial of Service in OpenDDS via SignedDocument Verification

Executive Summary

CVE-2026-52486 is a vulnerability in OpenDDS 3.33.x where a local attacker can cause a denial of service via the verify function in the SIgnedDocument module. The issue stems from improper handling of signed documents, particularly when verifying cryptographic signatures in governance and permissions files signed with OpenSSL's default command.

Useful 0 Not Useful 0

Detection Guidance

Check if OpenDDS 3.33.x is installed by running: opendds -v or checking package managers like apt or yum. Inspect SignedDocument.cpp in the OpenDDS/dds/DCPS/security/SSL directory for the verify function. Test signed governance or permissions files using openssl cms -verify -inform SMIME to compare OpenDDS verification results.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow an attacker to disrupt services by causing a denial of service. It may also prevent secure participant creation in DDS-Security due to failed signature verification, even with valid signatures and CA materials. Systems relying on OpenDDS for secure communication could become unavailable or insecure.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance by failing to enforce secure participant creation and cryptographic verification, potentially violating data integrity and confidentiality requirements in GDPR and HIPAA. Non-compliance may arise if secure communication channels are not maintained due to failed signature verification.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenDDS to a patched version if available. Avoid using application/pkcs7-mime signed files; use multipart/signed S/MIME documents instead. Manually verify signed files with openssl cms -verify before loading them into OpenDDS.

Useful 0 Not Useful 0