Executive brief
MOOS-IvP is a middleware and autonomy framework for autonomous marine vehicles and robotic platforms. An attacker can cause denial of service by flooding the shoreside broker (uFldNodeComms component) with reports containing unbounded distinct node identities, forcing it into quadratic-time processing that delays or prevents legitimate node communications from being distributed, effectively disabling command and control capabilities.
Technical details
The vulnerability is a quadratic processing complexity flaw in the uFldNodeComms component of MOOS-IvP. Each unique node identity in incoming reports triggers creation of a new ledger entry and initiates all-pairs distribution work, leading to quadratic time complexity as the number of distinct node identities grows. An attacker with network access to the broker can supply unbounded distinct node names in malformed or crafted reports to overwhelm processing. No authentication bypass or code execution is achieved; the impact is purely denial of service through computational exhaustion. Fix availability and patch details are not specified in the advisory.
Affected products
- MOOS-IvP MOOS-IvP through 24.8.1
Timeline
- 2026-09-03: disclosed