CVE-2026-85450: MOOS core-moos through 10.4.0 MOOSDB HTTP Server Resource Exhaustion
MOOS core-moos through 10.4.0 contains a denial of service vulnerability in the MOOSDB HTTP server that creates unbounded connections and threads without limits. Attackers can open many connections and send endless header data to exhaust server threads and memory, causing service unavailability.
Affected Software
Event History
Frequently Asked Questions
What systems are exposed to this denial-of-service issue?
Systems running MOOS core-moos through version 10.4.0 with the MOOSDB HTTP server reachable by an attacker are exposed. The attack is network-based and does not require authentication or user interaction.
What does an attacker need to do to cause service disruption?
An attacker can establish many connections to the MOOSDB HTTP server and continually send header data. The server creates unbounded connections and threads, allowing thread and memory exhaustion that makes the service unavailable.
What can be done while a fix is being deployed?
Restrict network access to the MOOSDB HTTP server so untrusted attackers cannot connect to it. Network controls that limit who can reach the HTTP service reduce exposure to connection and header-data flooding.