Description

MOOS-IvP uFldShoreBroker through 24.8.1 fails to limit the number of claimed communities stored in parallel vectors within ShoreBroker::handleMailNodePing(). A single publisher can supply unbounded distinct community names to grow retained state and per-pass work without limit, causing memory exhaustion and performance degradation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-03T23:17:24.760Z",
  "pubdate": "2026-09-03T23:17:24.760Z",
  "executiveSummary": "The MOOS-IvP uFldShoreBroker component, specifically in versions through 24.8.1, contains an improper input validation vulnerability within its message handling logic. The vulnerability resides in the ShoreBroker::handleMailNodePing() function, which fails to implement constraints on the number of unique community names processed from incoming network messages.\nThis flaw allows an attacker to conduct a denial-of-service (DoS) attack by supplying a stream of arbitrary, distinct community identifiers. Because the application stores these identifiers in parallel vectors without a defined upper limit, an attacker can induce unbounded memory consumption and excessive CPU cycles during internal loop iterations. The impact is significant, as it leads to service degradation or complete application crashes due to memory exhaustion. No specific authentication is noted as a barrier for this exploitation, assuming the attacker can deliver a ping message to the target node. Organizations using the affected software are at risk of system instability when exposed to untrusted network traffic.",
  "technicalDetails": "The vulnerability is located in the ShoreBroker::handleMailNodePing() function within the MOOS-IvP uFldShoreBroker component. The root cause is the absence of a capacity limit or a verification mechanism for the community names provided within incoming mail node pings. When the component processes these pings, it parses the community identifiers and inserts them into internal parallel vectors used to maintain state about connected or discovered communities.\nIn the standard execution flow, ShoreBroker monitors and tracks communities to facilitate inter-process communication within the MOOS-IvP ecosystem. However, the implementation does not perform bounds checking or validation against the number of unique entries stored in these vectors. An attacker can exploit this by injecting a sequence of forged ping packets, each containing a novel, unique string as the community name. As the function handles each ping, it persistently adds these distinct entries into the memory-resident vectors.\nThe exploitation flow proceeds as follows: First, the attacker identifies a reachable uFldShoreBroker instance. Second, the attacker transmits a high volume of malformed or legitimate-looking mail node ping messages containing randomized or unique community identifiers. Third, the function ShoreBroker::handleMailNodePing() is invoked for every received packet. Because there is no logic to prune old entries or enforce a maximum capacity on the tracking vectors, the memory footprint of the ShoreBroker process expands linearly with each unique community processed. Finally, the system experiences a steady increase in heap allocation. Furthermore, since the application must iterate over these vectors during internal state synchronization or status reporting cycles, the time complexity per-pass increases, leading to a degradation in performance that manifests as increased CPU utilization and eventual service latency. When the process consumes all available system memory, the operating system may trigger an Out-Of-Memory (OOM) killer event or the application may fail to allocate further objects, leading to a denial-of-service condition.\nThis vulnerability is particularly critical because it requires minimal interaction and exploits the fundamental message handling path of the ShoreBroker utility. The state retained is long-lived, and the lack of sanitation ensures that an attacker can exhaust system resources over time or rapidly, depending on the network throughput available to the adversary. The affected component is consistently exposed in distributed maritime robotic environments where MOOS-IvP nodes communicate over network interfaces."
}