CVE-2021-38443 - CVE House
Back to Database
Status published Medium CVE-2021-38443

Eclipse CycloneDDS Improper Handling of Syntactically Invalid Structure

Vulnerability Description

Eclipse CycloneDDS versions prior to 0.8.0 improperly handle invalid structures, which may allow an attacker to write arbitrary values in the XML parser.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-38443

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Federico Maggi (Trend Micro Research), Ta-Lun Yen, and Chizuru Toyama (TXOne Networks, Trend Micro) reported these vulnerabilities to CISA. In addition, Patrick Kuo, Mars Cheng (TXOne Networks, Trend Micro), Víctor Mayoral-Vilches (Alias Robotics), and Erik Boasson (ADLINK Technology) also contributed to this research.

References

More from Eclipse

View All →
CVE-2023-5632
Unconditionally adding an event to the epoll causes excessive CPU consumption
High 7.5
CVE-2023-3592
In Mosquitto before 2.0.16, a memory leak occurs when clients...
Medium 5.8
CVE-2023-0809
In Mosquitto before 2.0.16, excessive memory is allocated based on...
Medium 5.8
CVE-2021-38441
Eclipse CycloneDDS Write-what-where Condition
Medium 6.6

Affected Vendor

Affected Software

CycloneDDS
Vulnerable Versions:
unspecified

Timeline

Official Publish: May 5th, 2022
Last Modified: April 16th, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

Weaknesses (CWE)

CWE-228

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.