CVE-2024-10838 is a critical integer underflow flaw (CVSS 9.1) in Eclipse Cyclone DDS. During deserialization, an unauthenticated user may read out of bounds heap memory, which can expose secret data or cause crashes and denial of service. The GitHub advisory lists 0.10.5 as the patched version. Upgrade to it or later.
What's affected
The GitHub advisory GHSA-6jj6-w25p-jc42 lists affected versions as anything before 0.10.5, with 0.10.5 patched. The Cyclone DDS 0.10.5 release notes describe a bug fix release, including fixes in the authentication plugin. The advisory points to the functions DDS_Security_Deserialize_OctetSeq and DDS_Security_Deserialize_String as the place where the length check goes wrong.
The advisory itself rates the issue High at 8.6, while the CVE record carries a critical score of 9.1. The difference comes from different scoring of confidentiality and integrity impact. The fix is the same either way.
How to check if you're exposed
Find the Cyclone DDS version in use. If you built it from source, check the tag. If you installed a package, ask your package manager:
dpkg -l | grep -i cyclone
rpm -qa | grep -i cyclone
In a ROS 2 based system, Cyclone DDS often arrives as part of the middleware layer, so look in the dependency list of your robot or vehicle software image. The free dependency scan can read a manifest and flag known issues in packages you list.
Then check whether your deployment uses DDS Security. The vulnerable functions are named in the security plugin code, so a deployment that does not load it may have less exposure. Confirm that from the project advisory and your own configuration before relying on it.
What to do now
- Find every system that embeds Cyclone DDS, including robots, simulators and edge devices.
- Upgrade to 0.10.5 or later, then rebuild and redeploy images.
- Keep DDS traffic on a trusted network segment, because the advisory describes an unauthenticated network attacker.
- Review the project release notes for further fixes, since newer releases exist beyond 0.10.5.
- Add Cyclone DDS to your software inventory so the next advisory is easy to match.
Why it matters
An integer underflow (CWE-191) happens when a subtraction goes below zero in an unsigned number and wraps around to a very large value. In this case, a length check goes wrong, and code that should refuse a malformed input instead reads past the end of a buffer. Reading beyond a buffer can reveal what sits next to it in memory, such as key material or pointers that show how memory is laid out.
The advisory is honest about what is known. The maintainer writes that there may be a way for an attacker to read the values back, though no way had been found, and that the worst proven effect is a crash and denial of service. That matters for robotics and industrial systems, where a crashed communication thread can interrupt the work the system does. The CVE is not on the CISA Known Exploited Vulnerabilities list.
Quick check
Which version fixes it?
Eclipse Cyclone DDS 0.10.5, per the GitHub advisory.
Can an attacker steal keys with this?
The advisory says data could be exposed in principle, but the maintainer had not found a way to read it back. The proven effect is a crash.
Sources
- GitHub security advisory GHSA-6jj6-w25p-jc42
- Cyclone DDS 0.10.5 release
- Eclipse CVE assignment issue
Last reviewed: 19 October 2026.
