MOOS core-moos CVE-2026-85450

No special conditions are required for exploitation. The MOOSDB HTTP server accepts unauthenticated TCP connections by default on any network interface it is bound to, and no session state, credential, or prior interaction is needed before the resource exhaustion begins. The sole prerequisite is network reachability to the MOOSDB HTTP port. Deployments that bind MOOSDB exclusively to the loopback interface or that enforce strict firewall rules restricting access to the HTTP port to trusted hosts are substantially protected, as the attack surface does not exist if the port is inaccessible. All versions through 10.4.0 are affected regardless of any other MOOSDB configuration setting.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) is internally consistent: the attack is fully unauthenticated, requires no special configuration, is reachable over the network, and results in full availability loss of the MOOSDB process. No EPSS data was provided, and the vulnerability is not currently listed in CISA KEV, indicating exploitation has not yet been observed at scale. Despite the absence of a public exploit, the attack primitive is elementary - a simple TCP client sending non-terminating data - so automatable mass exploitation is feasible whenever MOOSDB HTTP ports are exposed. For production MOOS deployments, MOOSDB is the single communication hub for all MOOS modules; crashing it severs all inter-module messaging, making this a mission-critical availability threat even in a small deployment. Operators running MOOS-based AUV or field-robotics infrastructure, even a mid-sized research team in swidnica deploying MOOS on a robotic testbed, should treat the patch or network-level mitigations as an immediate priority given the zero-prerequisite exploitation path. The DoS-only impact (no confidentiality or integrity exposure) correctly limits the severity ceiling compared to a code-execution class flaw.

An unauthenticated attacker with network access to the MOOSDB HTTP port opens dozens of simultaneous TCP connections and, on each connection, transmits HTTP header data character-by-character without ever sending a terminating CRLF pair or keeps sending new header lines indefinitely. Pre-patch, each connection holds one thread and one file descriptor inside the MOOSDB process with no timeout eviction; memory and thread pool exhaustion accumulates until MOOSDB is unresponsive, severing all pub-sub communication between MOOS modules and halting any autonomous system dependent on MOOSDB for inter-process messaging.