MOOS-IvP versions through 24.8.1 contain a quadratic processing vulnerability in uFldNodeComms where each new node identity creates a ledger entry and triggers all-pairs distribution work. Attackers can supply unbounded distinct node names in reports to drive the shoreside broker into quadratic processing, delaying or preventing distribution of legitimate node reports.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://github.com/moos-ivp/moos-ivp/blob/1de9ae146cd63c209e8c3fd81611a4ed2472971b/ivp/src/uFldNodeComms/FldNodeComms.cpp#L169 Issue Tracking, Patch
- https://github.com/moos-ivp/moos-ivp/commit/8e30008d4eb68d83797187bd46e929e6cb06b195 Issue Tracking, Patch
- https://github.com/moos-ivp/moos-ivp/pull/131 Issue Tracking, Patch
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 8.7 · mitNVD modified 2026-10-14 23:31
Affected (CPE criteria) 1
cpe:2.3:a:mit:moos-ivp:*:*:*:*:*:*:*:*
References 5
- https://github.com/moos-ivp/moos-ivp Product
- https://github.com/moos-ivp/moos-ivp/blob/1de9ae146cd63c209e8c3fd81611a4ed2472971b/ivp/src/uFldNodeComms/FldNodeComms.cpp#L169 Issue Tracking, Patch
- https://github.com/moos-ivp/moos-ivp/commit/8e30008d4eb68d83797187bd46e929e6cb06b195 Issue Tracking, Patch
- https://github.com/moos-ivp/moos-ivp/pull/131 Issue Tracking, Patch
- https://www.vulncheck.com/advisories/moos-ivp-through-24.8.1-ufldnodecomms-quadratic-processing-denial-of-service Third Party Advisory