MOOS-IvP uFldShoreBroker through 24.8.1 fails to limit the number of claimed communities stored in parallel vectors within… (CVE-2026-85448)

The MOOS-IvP uFldShoreBroker component up to version 24.8.1 does not impose limits on the number of claimed communities stored in parallel vectors within the ShoreBroker::handleMailNodePing() function. An attacker acting as a publisher can supply an unlimited number of distinct community names, causing the broker to retain excessive state and perform increasing amounts of work per processing pass. This leads to memory exhaustion and degraded performance, constituting a denial-of-service condition. The vulnerability is tracked as CVE-2026-85448 and is associated with CWE-770 (Allocation of Resources Without Limits or Throttling).

The vulnerability allows an unauthenticated remote attacker to cause memory exhaustion and performance degradation in the affected MOOS-IvP uFldShoreBroker service. This results in a denial-of-service condition, impacting availability. There is no impact on confidentiality or integrity according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider limiting exposure of the affected service to untrusted publishers or applying resource usage monitoring and controls to mitigate potential memory exhaustion.