Description

MOOS core-moos through 10.4.0 contains a denial of service vulnerability in MOOSCommServer::ListenLoop() where the accept thread performs a blocking receive without timeout during the wire-protocol handshake. An attacker can open a TCP connection to the MOOSDB port and send no data, causing the accept thread to block indefinitely while holding the socket-list lock, preventing all subsequent client connections.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-03T23:17:24.030Z",
  "pubdate": "2026-09-03T23:17:24.030Z",
  "executiveSummary": "MOOS core-moos versions up to 10.4.0 contain a critical Denial of Service (DoS) vulnerability within the MOOSCommServer::ListenLoop() function.\nThe vulnerability arises from a blocking socket operation during the initial TCP wire-protocol handshake, which lacks a configured timeout.\nAn unauthenticated, remote attacker can exploit this by initiating a TCP connection to the MOOSDB port and intentionally withholding all data.\nThis behavior triggers a thread-blocking condition that persists indefinitely, causing the application to hold a socket-list mutex while awaiting data that will never arrive.\nAs a result, the MOOSDB server becomes unable to process new incoming client connections, effectively suspending availability for the entire mission-oriented operating suite communications.\nThe risk implication is high for distributed systems relying on MOOSDB for real-time coordination, as the exploit is trivial to execute and does not require complex payloads or elevated privileges.",
  "technicalDetails": "The root cause of this vulnerability is an improperly managed I/O blocking operation within the MOOSCommServer::ListenLoop() component. In the standard MOOS communication architecture, the server thread is responsible for accepting incoming connections via a listening socket.\nDuring the initiation of a connection, the MOOSDB expects a handshake process to establish the communication protocol. However, the implementation of MOOSCommServer::ListenLoop() invokes a blocking receive call that does not implement a timeout mechanism. Because the thread performs this synchronous read operation before fully offloading or validating the connection state, it remains locked in a waiting state indefinitely if a client simply completes the TCP three-way handshake but transmits no further application-layer data.\nThe severity of this issue is compounded by the thread's interaction with synchronization primitives. The ListenLoop process maintains a mutex on the global socket-list while performing this blocking wait. By holding this lock, the thread prevents any other legitimate connection attempts from being registered, accepted, or managed by the server. Essentially, a single malicious connection acts as a resource exhaustion vector that locks the entire communication management subsystem.\nThe attack flow follows a straightforward progression: First, the attacker identifies the active MOOSDB port (typically via port scanning or network reconnaissance). Second, the attacker initiates a standard TCP SYN-SYN/ACK-ACK handshake. Third, instead of sending the expected protocol handshake packet, the attacker maintains the connection in an open, idle state. Fourth, because the MOOSCommServer::ListenLoop() is stuck in the blocking read call, the lock on the socket-list remains held, effectively freezing the listener thread. No further client connections can be processed, as subsequent attempts are queued or rejected because the primary listener thread cannot return to the accept loop until the current thread unblocks. This state persists until the attacker closes the TCP connection or the network stack times out the dead connection, during which time the MOOSDB remains unresponsive to legitimate nodes in the MOOS community."
}