4.5. Vulnerabilities

The following vulnerabilities are fixed in this release.

See also RTI Connext Security Bulletins and Advisories for a complete list of vulnerabilities in RTI releases that have been published through the CVE® Program. That list may be more up-to-date.

4.5.1. [Critical] Potential Denial of Service in RTI Security Plugins for OpenSSL when loading Private Key

The RTI Security Plugins depended on OpenSSL 3.5.1, which is known to be affected by the CVE-2026-22795 publicly disclosed vulnerability.

This vulnerability has been fixed by upgrading OpenSSL to the latest stable version, 3.5.5.

User Impact without Security

Not applicable (affects a security-specific product/feature only).

User Impact with Security

[RTI Issue ID SEC-2895]

4.5.2. [Critical] Potential stack buffer overflow in RTI Security Plugins for OpenSSL when loading Private Key

The RTI Security Plugins depended on OpenSSL 3.5.1, which is known to be affected by the CVE-2025-11187 publicly disclosed vulnerability.

This vulnerability has been fixed by upgrading OpenSSL to the latest stable version, 3.5.5.

User Impact without Security

Not applicable (affects a security-specific product/feature only).

User Impact with Security

[RTI Issue ID SEC-2894]

4.5.3. [Critical] Potential Denial of Service in RTI Security Plugins for OpenSSL when parsing Permissions Document

The RTI Security Plugins depended on OpenSSL 3.5.1, which is known to be affected by the CVE-2026-22796 publicly disclosed vulnerability.

This vulnerability has been fixed by upgrading OpenSSL to the latest stable version, 3.5.5.

User Impact without Security

Not applicable (affects a security-specific product/feature only).

User Impact with Security

[RTI Issue ID SEC-2893]

4.5.4. [Critical] Potential Denial of Service in RTI Security Plugins for OpenSSL when configuring client proxy

The RTI Security Plugins depended on OpenSSL 3.5.1, which is known to be affected by the CVE-2025-9232 publicly disclosed vulnerability.

This vulnerability has been fixed by upgrading OpenSSL to the latest stable version, 3.5.5.

User Impact without Security

Not applicable (affects a security-specific product/feature only).

User Impact with Security

  • Exploitable Denial of Service in the RTI Security Plugins when the URL of the DomainParticipant’s OCSP responder has an IPv6 address and you configure a client proxy through the no_proxy and http_proxy (or https_proxy) environment variables. Note that the RTI Security Plugins do not support configuring a client proxy for OCSP responders.

  • CVSS v3.1 Base Score: 5.9 Medium

  • CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

  • CVSS 4.0 Base Score: 8.2 High

  • CVSS 4.0 Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

[RTI Issue ID SEC-2823]

4.5.5. [Critical] A malicious authenticated participant could impersonate other participants

A malicious participant (A) could bypass RTPS origin authentication to impersonate a participant (B). This allowed participant A to send messages to participant B that appeared to be sent by participant B itself. This exploit was only possible if participant B had already successfully completed the authentication process with the participant it intended to impersonate.

User Impact without Security

Not applicable (affects a security-specific product/feature only).

User Impact with Security

[RTI Issue ID SEC-2881]

4.5.6. [Critical] Origin Authentication could be bypassed by crafting malicious RTPS message

When Origin Authentication Protection was enabled, a malicious insider could bypass Origin Authentication Protection by crafting a malicious RTPS message. The only GUID that Origin Authentication Protection validates is the DDS_SampleInfo::publication_handle. Other GUIDs, such as the DDS_SampleInfo::original_publication_virtual_guid and the DDS_SampleInfo::source_guid (which may appear in the inline QoS), are not validated by Origin Authentication Protection. Depending on how the destination DataReader interprets these other GUIDs, this behavior could allow the malicious insider to send a message that appears to come from a different DataWriter. If the DataReader has not set dds.data_reader.state.filter_redundant_samples to 0, then the malicious insider could prevent the DataReader from receiving future samples from a legitimate DataWriter.

This problem has been fixed by adding a new Permissions Document tag called proxy, and a new Governance Document tag called default_proxy_permissions. When a DataWriter does not have proxy permissions, its samples are required to have original_publication_virtual_guid and source_guid equal to publication_handle. The DataReader drops any samples that do not meet this requirement. For more information on proxy permissions, see DataWriters Acting as a Proxy for other DataWriters, in the RTI Security Plugins User’s Manual 7.7.0.

The issue also affected endpoint discovery. When an endpoint does not have proxy permissions, its discovery messages are now required to have a DDS_PublicationBuiltinTopicData::virtual_guid (or DDS_SubscriptionBuiltinTopicData::virtual_guid) equal to the source_guid.

User Impact without Security

Not applicable (affects a security-specific product/feature only).

User Impact with Security

The impact on Security Plugins applications of using the previous version was as follows:

[RTI Issue ID SEC-2791]



* This bug does not affect you if you are upgrading from 7.3.x or earlier.