Login Request a demo
High severity · published Sep 3, 2026
CVE-2026-85446
MOOS-IvP through 24.8.1 uFldNodeComms Quadratic Processing Denial of Service
7.5
CVSS
0.8%
EPSS
No
On KEV
Description
MOOS-IvP versions through 24.8.1 contain a quadratic processing vulnerability in uFldNodeComms where each new node identity creates a ledger entry and triggers all-pairs distribution work. Attackers can supply unbounded distinct node names in reports to drive the shoreside broker into quadratic processing, delaying or preventing distribution of legitimate node reports.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
moos-ivp · moos-ivp
through 24.8.1 · source: vendor, NVD
Affected product
MO
moos-ivp
moos-ivp
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-85446
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-85446
Product
https://github.com/moos-ivp/moos-ivp
Issue Tracking
https://github.com/moos-ivp/moos-ivp/blob/1de9ae146cd63c209e8c3fd81611a4ed2472971b/ivp/src/uFldNodeComms/FldNodeComms.cpp#L169
Issue Tracking
https://github.com/moos-ivp/moos-ivp/commit/8e30008d4eb68d83797187bd46e929e6cb06b195
Issue Tracking
https://github.com/moos-ivp/moos-ivp/pull/131
Third Party Advisory
https://www.vulncheck.com/advisories/moos-ivp-through-24.8.1-ufldnodecomms-quadratic-processing-denial-of-service
More from moos-ivp
9.8
CVE-2026-85438
MOOS-IvP through 24.8.1 Out-of-Bounds Write via Unvalidated IvP Payload Counts
9.8
CVE-2026-85437
MOOS-IvP through 24.8.1 Buffer Overflow in IvP Function String Decoders
9.8
CVE-2026-85426
MOOS-IvP through 24.8.1 uMemWatch Command Injection via MOOS Client Names
9.8
CVE-2026-85425
MOOS-IvP through 24.8.1 iSay Command Injection via SAY_MOOS
9.1
CVE-2026-85435
MOOS-IvP through 24.8.1 uFldNodeBroker Unauthenticated Shore Route Enrollment