CVE-2026-85450

MOOS core-moos through 10.4.0 contains a denial-of-service flaw in the MOOSDB HTTP server, which accepts client connections and spawns worker threads without any limits (CWE-770). A remote, unauthenticated attacker can open many simultaneous connections and send endless or never-terminating header data, consuming all available server threads and memory. The result is unavailability of MOOSDB — the central publish/subscribe hub of a MOOS deployment — disrupting the robots, simulators, and autonomy processes that depend on it; the CVSS 4.0 vector indicates no confidentiality or integrity impact, only high availability impact. Anyone running an affected MOOSDB instance, up to and including version 10.4.0, is affected. No public proof-of-concept or known exploitation exists; EPSS estimates a 0.4% probability of exploitation within 30 days and the issue is not in CISA KEV.

What to do: Restrict access to the MOOSDB HTTP interface to trusted hosts using firewall rules or ACLs, and cap or rate-limit concurrent connections at the network layer where possible. Upgrade core-moos to a release newer than 10.4.0 as soon as a patched version is published, and in the meantime monitor MOOSDB thread counts and memory usage, restarting the service if exhaustion occurs. Given no known PoC or in-the-wild exploitation and low EPSS, treat this as a moderate-priority availability hardening item rather than an emergency.