Only the latest release is supported with security fixes.

Do not open a public GitHub issue.

Report security vulnerabilities to:

Matheus.zeitune.developer@gmail.com

Include the following in your report:

• Description of the vulnerability and its impact
• Steps to reproduce or a proof-of-concept
• Affected version (commit hash or release tag)
• Relevant logs or stack traces
• Any suggested mitigation

We use CVSS v3.1 for severity scoring. Disclosure is coordinated with the reporter.

• Memory safety violations in the Rust API surface (cyclonedds crate)
• Undefined behavior crossing the FFI boundary (cyclonedds-rust-sys)
• DDS Security misconfiguration (certificate validation, governance/permissions XML)
• CDR deserialization panics or out-of-memory conditions from malformed data
• Supply chain attacks via dependency confusion or compromised crates
• Privilege escalation through DDS discovery or participant impersonation
• Timing side-channels in security-critical operations

• Denial of service attacks against the CycloneDDS C daemon (upstream: Eclipse CycloneDDS)
• Vulnerabilities in dependencies already fixed in the latest version
• Physical access attacks
• Social engineering
• Issues in experimental features (no_std, WASM) unless they affect the main std path

This project supports DDS Security via the security feature flag:

[dependencies]
cyclonedds = { version = "3.0.0-alpha.3", features = ["security"] }

When the security feature is enabled, cyclonedds-rust-sys configures and builds the bundled CycloneDDS with ENABLE_SECURITY=ON and compiles the authentication, cryptography and access-control plugin libraries (dds_security_auth, dds_security_crypto, dds_security_ac) that CycloneDDS loads at runtime. OpenSSL development headers must be available on the build machine.

See docs/security-guide.md and docs/security-production.md for configuration details.