Executive brief
OpenDDS is a middleware framework used to enable secure distributed real-time data exchange in critical systems. A signature verification flaw in the DDS-Security module prevents operators from using standard cryptographic tools (OpenSSL) to sign governance and permissions documents, forcing security configuration to fail even when the signatures are valid. This is a fail-closed denial of service that breaks the ability to enable security features on deployments.
Technical details
The vulnerability is an improper verification of cryptographic signature (CWE-347) in the SignedDocument::verify() function within OpenDDS 3.33.x. The root cause lies in how load_file() stores file content with a synthetic trailing null byte (buffer length = file_size + 1), then passes the incorrect length to BIO_write() and SMIME_read_PKCS7() when processing application/pkcs7-mime S/MIME documents. While OpenSSL command-line tools verify the same .p7s files successfully, OpenDDS rejects them during local verification, preventing participants from being created with DDS-Security enabled. The attack is local (requires file system access to governance/permissions documents) and fail-closed—no authentication bypass occurs, but legitimate signed documents generated with standard openssl cms -sign cannot be used. Patches should correct the buffer length calculation in the verify() code path.
Affected products
- OpenDDS Project OpenDDS 3.33.x
Timeline
- 2026-09-08: disclosed
- 2026-09-08: advisory: CVE-2026-52486 published