CVE-2026-85442
MOOS core-moos through 10.4.0 MOOSDB Denial of Service via Unbounded Packet Allocation
Published Sep 3, 2026 · updated Oct 14, 2026 · themoos core-moos
MOOS core-moos through 10.4.0 fails to validate packet length declarations in CMOOSCommPkt::OnBytesWritten(), allowing unauthenticated attackers to trigger unbounded buffer allocation by sending crafted wire packets. Attackers can send packets with large declared lengths to exhaust server memory and cause denial of service before client authentication completes.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Sep 3, 2026 · NIST NVD
Detected
MOOS core-moos through 10.4.0 fails to validate packet length declarations in CMOOSCommPkt::OnBytesWritten(), allowing unauthenticated attackers to trigger unbounded buffer allocation by sending crafted wire packets. Attackers can send packets with large declared lengths to exhaust server memory and cause denial of service before client authentication completes.
Oct 14, 2026 · NIST NVD
Updated
MOOS core-moos through 10.4.0 fails to validate packet length declarations in CMOOSCommPkt::OnBytesWritten(), allowing unauthenticated attackers to trigger unbounded buffer allocation by sending crafted wire packets. Attackers can send packets with large declared lengths to exhaust server memory and cause denial of service before client authentication completes.
Affected
- cpe themoos/core-moosversion unspecified
- vendor themoos core-moosversion unspecified
Sources
- CIRCL Vulnerability LookupVulnerability recordCVE-2026-85442
MOOS core-moos through 10.4.0 fails to validate packet length declarations in CMOOSCommPkt::OnBytesWritten(), allowing unauthenticated attackers to trigger unbounded buffer allocation by sending crafted wire packets. Attackers can send packets with large declared lengths to exhau
vulnerability.circl.lu - CVE.orgVulnerability recordCVE-2026-85442
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-85442
30-day exploitation probability 0.8%
first.org - NIST NVDVulnerability recordCVE-2026-85442
MOOS core-moos through 10.4.0 fails to validate packet length declarations in CMOOSCommPkt::OnBytesWritten(), allowing unauthenticated attackers to trigger unbounded buffer allocation by sending crafted wire packets. Attackers can send packets with large declared lengths to exhau
nvd.nist.gov