Description

MOOS-IvP pRealm through version 24.8.1 accepts unbounded REALMCAST_REQ subscriptions without validating duration or variable list limits. Attackers can register long-lived pipeways with many variables to cause pRealm to generate excessive output indefinitely, exhausting system resources.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-03T23:17:24.610Z",
  "pubdate": "2026-09-03T23:17:24.610Z",
  "executiveSummary": "The MOOS-IvP pRealm component, through version 24.8.1, is susceptible to a resource exhaustion vulnerability due to a lack of input validation on REALMCAST_REQ subscriptions.\nThis vulnerability is categorized as an improper limitation of resource consumption, allowing an attacker to register unbounded pipeways with an unlimited number of variables and indefinite durations.\nBy manipulating these subscription parameters, an attacker can force pRealm to generate excessive output, leading to severe system resource depletion, including CPU and memory exhaustion, which effectively degrades or denies service for legitimate operations.\nThe vulnerability does not require complex authentication mechanisms, assuming the attacker has access to the MOOS community message bus.\nThe risk is significant in multi-agent autonomous systems where stability is critical, as a successful exploitation can lead to a complete collapse of the pRealm monitoring process and potential cascading failures within the MOOS-IvP architecture.",
  "technicalDetails": "The vulnerability resides in the pRealm application's message processing logic, specifically in how it handles REALMCAST_REQ subscriptions. The application fails to enforce constraints on either the temporal duration of a subscription or the quantity of variables requested per subscription request.\nIn the MOOS-IvP publish-subscribe middleware architecture, pRealm acts as a monitoring bridge. When a client sends a malformed or malicious REALMCAST_REQ message, the application creates a 'pipeway'—a persistent data conduit—without verifying the resource overhead requested by the client.\nAn attacker can exploit this by flooding the system with requests to track a high volume of MOOS variables over an indefinite duration. Because pRealm allocates resources to track and transmit these variables to the requester, the process experiences a continuous increase in memory allocation and CPU cycles dedicated to serializing and dispatching these messages.\nThe exploitation flow consists of: 1. Identification of the MOOS community message bus. 2. Sending a crafted REALMCAST_REQ message that specifies a large list of monitored variables. 3. Setting the duration parameter to a maximum or infinite value. 4. Repetitive invocation of this request to accumulate active pipeways.\nThe vulnerable component is the subscription management logic within pRealm. Affected versions include all releases of MOOS-IvP through 24.8.1. There are no built-in authorization checks to limit which entities can issue these requests, meaning any process with network or process-level access to the MOOSDB can act as a malicious actor.\nAs the number of active, unbounded pipeways grows, pRealm's main loop becomes saturated with the overhead of maintaining these connections. Eventually, the process reaches OS-level limits, such as file descriptor exhaustion or heap memory limits, resulting in a crash or non-responsiveness (Denial of Service).\nPost-exploitation impact involves the total failure of system monitoring, preventing operators from diagnosing the state of the autonomy mission. Furthermore, because pRealm is often a central utility, its failure can interrupt telemetry pipelines necessary for safe autonomous operation, potentially forcing the system into an undefined or emergency state."
}