Description

MOOS-IvP versions through 24.8.1 contain a quadratic processing vulnerability in uFldNodeComms where each new node identity creates a ledger entry and triggers all-pairs distribution work. Attackers can supply unbounded distinct node names in reports to drive the shoreside broker into quadratic processing, delaying or preventing distribution of legitimate node reports.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-03T23:17:24.467Z",
  "pubdate": "2026-09-03T23:17:24.467Z",
  "executiveSummary": "The uFldNodeComms component within MOOS-IvP versions up to 24.8.1 is susceptible to a quadratic complexity vulnerability leading to a Denial-of-Service (DoS) condition.\nThe flaw stems from the inefficient handling of node identity registration and the subsequent distribution of ledger updates.\nAn unauthenticated attacker capable of submitting node reports to the shoreside broker can inject an unbounded number of unique node names, forcing the system to perform exhaustive all-pairs distribution calculations.\nThis excessive computational load exhausts system resources, resulting in significant latency or the complete failure of the broker to distribute legitimate node reports.\nThe vulnerability poses a severe risk to mission-critical autonomous underwater vehicle (AUV) communications, as it can disrupt tactical awareness and command-and-control loops.\nExploitation requires no special privileges, merely the ability to communicate with the network interface where uFldNodeComms monitors for node reports.",
  "technicalDetails": "The vulnerability resides within the internal message routing and ledger management logic of the uFldNodeComms application. In MOOS-IvP, uFldNodeComms serves as the central clearinghouse for node reports relayed from autonomous vehicles to the shoreside station.\nRoot Cause: The system maintains a ledger of active nodes to facilitate report distribution. The flaw exists because the application architecture triggers an all-pairs processing loop whenever a new or unique node identity is registered. As the number of unique node identifiers (N) increases, the algorithm performs a computational operation that scales at O(N^2) complexity.\nAttack Flow: An attacker initiates the exploitation by flooding the uFldNodeComms process with forged node reports. Each report contains a randomized or spoofed, previously unseen node identity string. Upon receiving each packet, the application registers the new identity in its ledger. Immediately following the update, the broker initiates an all-pairs propagation procedure to ensure all known nodes are synchronized with the updated state.\nExploitation Dynamics: By injecting a continuous stream of distinct node names, the attacker forces the CPU to spend an increasing amount of time calculating distribution routes for every newly added node against the entire existing set. Because the processing time grows quadratically, the system quickly reaches a point of resource saturation where the event loop is blocked by the distribution calculations.\nImpact: As the computational cost per report increases with each injected node, the latency of the broker rises exponentially. This causes the uFldNodeComms thread to block, preventing the timely processing of legitimate reports from valid network assets. In a real-world scenario, this results in the loss of telemetry, state awareness, and mission control capability for the entire MOOS community, effectively rendering the shoreside command structure blind.\nExposure: The vulnerability is reachable via standard MOOS message communication protocols. Because uFldNodeComms is typically exposed to receive reports from remote assets, any actor with network access to the broker's listening port can execute this attack without needing authenticated access to the underlying OS."
}