# CVE-2026-85450: MOOS core-moos denial of service in MOOSDB HTTP server

Source: https://junglewise.ai/threats/cve-2026-85450-moos-core-moos-denial-of-service-in-moosdb-http-server  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-85450 · Severity: high · CVSS 7.5 · Published 2026-09-03

MOOS core-moos is a lightweight middleware platform used in robotics and autonomous systems. The MOOSDB HTTP server fails to enforce limits on incoming connections and thread creation, allowing attackers to overwhelm the system by opening many concurrent connections and sending endless header data. This exhausts server resources and causes service outages, disrupting operations of systems relying on MOOS for real-time data distribution.

Technologies: [MOOS Core-Moos](https://junglewise.ai/threats/technologies/core-moos). Vendors: [MOOS](https://junglewise.ai/threats/vendors/moos).

## Quick answers

**Is CVE-2026-85450 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85450 being exploited in the wild.

**How severe is CVE-2026-85450?** High severity, with a CVSS score of 7.5, published 3 September 2026.

**Which products and versions are affected?** MOOS Core-Moos through 10.4.0.

**Is there a fix for CVE-2026-85450?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-85450 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-85450?** Check whether you run MOOS Core-Moos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a resource exhaustion / denial of service flaw in the MOOSDB HTTP server component, specifically in the HTTPConnection handler. The root cause is the absence of connection limits and per-connection bounds checks on HTTP header data processing. An attacker on the network can send specially crafted HTTP requests with unbounded headers or open many simultaneous connections without authentication, causing the server to create threads and allocate memory without limits. This leads to thread pool exhaustion and out-of-memory conditions. Patches and fixes are expected in future releases; users should upgrade beyond version 10.4.0.

## Affected products

- MOOS core-moos through 10.4.0

## Timeline

- 2026-09-03: disclosed

## References

- [https://github.com/themoos/core-moos](https://github.com/themoos/core-moos)
- [https://github.com/themoos/core-moos/blob/ec9c77c68fcbdef8f5e4c60fe243acd223433f0c/Core/libMOOS/DB/HTTPConnection.cpp](https://github.com/themoos/core-moos/blob/ec9c77c68fcbdef8f5e4c60fe243acd223433f0c/Core/libMOOS/DB/HTTPConnection.cpp)

## Related threats

- [MOOS core-moos buffer over-read in CMOOSCommPkt deserialization](https://junglewise.ai/threats/cve-2026-85455-moos-core-moos-buffer-over-read-in-cmooscommpkt-deserialization)
- [MOOS core-moos buffer overflow in CMOOSSerialPort](https://junglewise.ai/threats/cve-2026-85454-moos-core-moos-buffer-overflow-in-cmoosserialport)
- [MOOS core-moos DOM-based XSS in HTTP MOOSDB interface](https://junglewise.ai/threats/cve-2026-85453-moos-core-moos-dom-based-xss-in-http-moosdb-interface)
- [MOOS core-moos remote process termination via hardcoded multicast passphrase](https://junglewise.ai/threats/cve-2026-85451-moos-core-moos-remote-process-termination-via-hardcoded-multicast)
- [MOOS core-moos denial of service in MOOSCommServer](https://junglewise.ai/threats/cve-2026-85443-moos-core-moos-denial-of-service-in-mooscommserver)