Denial of Service Vulnerability in MOOS Database by The MOOS Vendor
CVE-2026-85443

8.7HIGH

Key Information:

Vendor

Themoos

Status
Core-moos
Vendor
CVE Published:
3 September 2026

What is CVE-2026-85443?

The MOOS core-moos software, up to version 10.4.0, is susceptible to a denial of service vulnerability within the MOOSCommServer::ListenLoop() function. This occurs when an attacker establishes a TCP connection to the MOOSDB port but sends no data, causing the accept thread to block indefinitely during the wire-protocol handshake. This prolonged blocking state holds the socket-list lock, effectively preventing any new client connections to the server and disrupting normal operations.

Affected Version(s)

core-moos 0 <= 10.4.0

References

https://github.com/themoos/core-moos/pull/83
issue-trackingpatch
https://github.com/themoos/core-moos/commit/8d940303949a8...
patch
https://github.com/themoos/core-moos
product

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Vlatko Kosturjak
.