Vulnerability · Published Sep 3, 2026 · Assigned by VulnCheck
CVE-2026-85450MOOS core-moos through 10.4.0 MOOSDB HTTP Server Resource Exhaustion
High 7.5
In plain English
A high-severity resource allocation without limits in core-moos from themoos. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.6%top 49.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
MOOS core-moos through 10.4.0 contains a denial of service vulnerability in the MOOSDB HTTP server that creates unbounded connections and threads without limits. Attackers can open many connections and send endless header data to exhaust server threads and memory, causing service unavailability.
Affected products (as reported)
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- Pull Request #79 issue-tracking, patch
- Proposed fix commit (pull request not merged) patch
- https://github.com/themoos/core-moos product
- HTTPConnection.cpp (verified sink) technical-description
- VulnCheck Advisory: MOOS core-moos through 10.4.0 MOOSDB HTTP Server Resource Exhaustion third-party-advisory