CVE-2026-85446 MOOS-IvP through 24.8.1 uFldNodeComms Quadratic Processing Denial of Service

What is CVE-2026-85446?

CVE-2026-85446 is a high-severity denial of service vulnerability in moos-ivp, published on 3 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

MOOS-IvP versions through 24.8.1 contain a quadratic processing vulnerability in uFldNodeComms where each new node identity creates a ledger entry and triggers all-pairs distribution work. Attackers can supply unbounded distinct node names in reports to drive the shoreside broker into quadratic processing, delaying or preventing distribution of legitimate node reports.

Weakness: CWE-407

Which versions are affected by CVE-2026-85446?

It affects 1 product.

Products include Mit Moos-Ivp.

How do I fix CVE-2026-85446?

No fix has been published for CVE-2026-85446 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-85446 being exploited?

There is no known exploitation of CVE-2026-85446 in the wild and no public exploit code.

Other vulnerabilities in moos-ivp

• CVE-2026-85425 MOOS-IvP through 24.8.1 iSay Command Injection via SAY_MOOS Critical 9.3
• CVE-2026-85434 MOOS-IvP through 24.8.1 uFldShoreBroker Bridge Route Injection via Unverified Node Ping Critical 9.3
• CVE-2026-85435 MOOS-IvP through 24.8.1 uFldNodeBroker Unauthenticated Shore Route Enrollment Critical 9.3
• CVE-2026-85437 MOOS-IvP through 24.8.1 Buffer Overflow in IvP Function String Decoders Critical 9.3
• CVE-2026-85438 MOOS-IvP through 24.8.1 Out-of-Bounds Write via Unvalidated IvP Payload Counts Critical 9.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-387j-4pfq-cmj4.