Vulnerability · Published Sep 3, 2026 · Assigned by VulnCheck
CVE-2026-85446MOOS-IvP through 24.8.1 uFldNodeComms Quadratic Processing Denial of Service
High 7.5
In plain English
A high-severity security flaw in moos-ivp from moos-ivp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.8%top 43.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
MOOS-IvP versions through 24.8.1 contain a quadratic processing vulnerability in uFldNodeComms where each new node identity creates a ledger entry and triggers all-pairs distribution work. Attackers can supply unbounded distinct node names in reports to drive the shoreside broker into quadratic processing, delaying or preventing distribution of legitimate node reports.
Affected products (as reported)
Weakness: CWE-407 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- Pull Request #131 issue-tracking, patch
- Proposed fix commit (pull request not merged) patch
- https://github.com/moos-ivp/moos-ivp product
- FldNodeComms.cpp (verified sink) technical-description
- VulnCheck Advisory: MOOS-IvP through 24.8.1 uFldNodeComms Quadratic Processing Denial of Service third-party-advisory