Description

MOOS core-moos through 10.4.0 contains a denial of service vulnerability in the MOOSDB HTTP server that creates unbounded connections and threads without limits. Attackers can open many connections and send endless header data to exhaust server threads and memory, causing service unavailability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-03T23:17:25.043Z",
  "pubdate": "2026-09-03T23:17:25.043Z",
  "executiveSummary": "The MOOSDB component within MOOS core-moos (up to 10.4.0) is susceptible to a denial-of-service (DoS) vulnerability originating from improper resource management in its HTTP server implementation.\nThe vulnerability manifests as an unbounded connection and thread allocation mechanism, allowing an unauthenticated remote attacker to exhaust critical server resources.\nBy initiating a high volume of concurrent connections and transmitting protracted, endless header data, an attacker can consume all available server threads and system memory.\nThis resource exhaustion directly leads to service unavailability, effectively crashing the MOOSDB process or rendering it unresponsive to legitimate administrative or mission-critical traffic.\nGiven that MOOS core-moos is frequently utilized in autonomous and robotics applications, the loss of availability in the MOOSDB—the central communication hub—can lead to catastrophic failures in mission-critical systems relying on real-time data exchange.\nExploitation requires only basic network access to the MOOSDB HTTP interface; no prior authentication is necessary, making this a high-risk vector for systems exposed to untrusted network segments.",
  "technicalDetails": "The root cause of this vulnerability lies in the architecture of the MOOSDB HTTP server, which fails to implement robust concurrency limits or connection timeouts when handling incoming HTTP requests.\nSpecifically, the server does not enforce a maximum threshold for simultaneous incoming connections, nor does it implement application-level resource quotas for thread spawning. Consequently, each incoming request is handled by a new thread, allowing an attacker to force the instantiation of an arbitrary number of threads until the host operating system's process limit or memory capacity is reached.\nThe exploitation flow proceeds as follows: First, the attacker establishes multiple TCP connections to the MOOSDB HTTP port. Second, rather than completing a standard request-response cycle, the attacker transmits incomplete or maliciously crafted HTTP headers that never terminate (e.g., streaming endless headers without a '\\r\\n\\r\\n' delimiter).\nBecause the MOOSDB HTTP server waits for these headers to be fully parsed before releasing the associated thread, the threads remain in a blocked or 'busy' state indefinitely. As the attacker maintains these connections, the server continues to spawn new threads for subsequent legitimate requests until the process reaches a state of resource exhaustion.\nThe vulnerability is further exacerbated by the lack of input sanitization and timeout mechanisms on the socket reading function. If the server lacks a defined 'read timeout' or 'keep-alive' timeout, it will remain tethered to the attacker's stalled connection, holding onto allocated memory buffers for the duration of the hanging request.\nThe impact of this behavior is total service denial. When the system memory is exhausted or the thread limit is reached, the MOOSDB process may trigger an out-of-memory (OOM) killer event or become deadlocked, preventing it from performing its primary function of message routing and database synchronization between MOOS applications.\nThis vulnerability is present in all versions of core-moos up to and including 10.4.0. The lack of authentication requirements and the reliance on standard network protocols mean that any system with network-reachable MOOSDB HTTP components is inherently vulnerable to this resource exhaustion attack."
}