Executive brief
MOOS core-moos is a lightweight middleware platform used in robotics and autonomous systems. The MOOSDB HTTP server fails to enforce limits on incoming connections and thread creation, allowing attackers to overwhelm the system by opening many concurrent connections and sending endless header data. This exhausts server resources and causes service outages, disrupting operations of systems relying on MOOS for real-time data distribution.
Technical details
The vulnerability is a resource exhaustion / denial of service flaw in the MOOSDB HTTP server component, specifically in the HTTPConnection handler. The root cause is the absence of connection limits and per-connection bounds checks on HTTP header data processing. An attacker on the network can send specially crafted HTTP requests with unbounded headers or open many simultaneous connections without authentication, causing the server to create threads and allocate memory without limits. This leads to thread pool exhaustion and out-of-memory conditions. Patches and fixes are expected in future releases; users should upgrade beyond version 10.4.0.
Affected products
- MOOS core-moos through 10.4.0
Timeline
- 2026-09-03: disclosed