Quick answers
- Is CVE-2026-85450 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-85450 being exploited in the wild.
- How severe is CVE-2026-85450?
- High severity, with a CVSS score of 7.5, published 3 September 2026.
- Which products and versions are affected?
- MOOS Core-Moos through 10.4.0.
- Is there a fix for CVE-2026-85450?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-85450 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-85450?
- Check whether you run MOOS Core-Moos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a resource exhaustion / denial of service flaw in the MOOSDB HTTP server component, specifically in the HTTPConnection handler. The root cause is the absence of connection limits and per-connection bounds checks on HTTP header data processing. An attacker on the network can send specially crafted HTTP requests with unbounded headers or open many simultaneous connections without authentication, causing the server to create threads and allocate memory without limits. This leads to thread pool exhaustion and out-of-memory conditions. Patches and fixes are expected in future releases; users should upgrade beyond version 10.4.0.
Affected products
- MOOS core-moos through 10.4.0
Timeline
- 2026-09-03: disclosed