CVE-2026-85450CWE-770denial-of-service

CVE-2026-85450

High · published September 4, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
49.4
In the wild
Unconfirmed
What it is

MOOS core-moos through 10.4.0 contains a denial of service vulnerability in the MOOSDB HTTP server that creates unbounded connections and threads without limits. Attackers can open many connections and send endless header data to exhaust server threads and memory, causing service unavailability.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00627 · 49.4th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-09-04T03:17Z
Affected products (1)
ProductVersionsFixed in
themoos/core-moos< 10.4.010.4.0
References (5)
https://github.com/themoos/core-moos · [email protected]https://github.com/themoos/core-moos/blob/ec9c77c68fcbdef8f5e4c60fe243acd223433f0c/Core/libMOOS/DB/HTTPConnection.cpp#L167 · [email protected]https://github.com/themoos/core-moos/commit/dfef92b3bc31886bc47e4d680aef583b78cb8d72 · [email protected]https://github.com/themoos/core-moos/pull/79 · [email protected]https://www.vulncheck.com/advisories/moos-core-moos-through-10.4.0-moosdb-http-server-resource-exhaustion · [email protected]
EPSS history
Timeline
  • 05 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 03 SEP 22:38Z
    MOOS core-moos through 10.4.0 MOOSDB HTTP Server Resource Exhaustion
    cvelistv5