CVE-2026-85450: Allocation of Resources Without Limits or Throttling in themoos core-moos

CVE-2026-85450 describes a denial of service vulnerability in the MOOS core-moos product through version 10.4.0. The MOOSDB HTTP server does not limit the number of connections or threads it creates, allowing an attacker to open many connections and send continuous header data. This leads to resource exhaustion of server threads and memory, resulting in service unavailability. The vulnerability is remotely exploitable without authentication or user interaction, and no vendor advisory or patch information is currently provided.

Successful exploitation results in denial of service by exhausting server resources such as threads and memory, making the MOOSDB HTTP server unavailable to legitimate users. The vulnerability affects availability but does not indicate impact on confidentiality or integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider limiting incoming connections at network or firewall level to mitigate potential exploitation.