Vulnerability Description
MOOS-IvP versions through 24.8.1 contain a quadratic processing vulnerability in uFldNodeComms where each new node identity creates a ledger entry and triggers all-pairs distribution work. Attackers can supply unbounded distinct node names in reports to drive the shoreside broker into quadratic processing, delaying or preventing distribution of legitimate node reports.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/moos-ivp/moos-ivp
- https://github.com/moos-ivp/moos-ivp/blob/1de9ae146cd63c209e8c3fd81611a4ed247297
- https://github.com/moos-ivp/moos-ivp/commit/8e30008d4eb68d83797187bd46e929e6cb06
- https://github.com/moos-ivp/moos-ivp/pull/131
- https://www.vulncheck.com/advisories/moos-ivp-through-24.8.1-ufldnodecomms-quadr
FAQ
What is CVE-2026-85446?
CVE-2026-85446 is a vulnerability with a CVSS score of 7.5 (HIGH). MOOS-IvP versions through 24.8.1 contain a quadratic processing vulnerability in uFldNodeComms where each new node identity creates a ledger entry and triggers all-pairs distribution work. Attackers c...
How severe is CVE-2026-85446?
CVE-2026-85446 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-85446?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.