ZeroDay Findings
Sign inSign up

Findings

CVE-2026-85446

MOOS-IvP versions through 24.8.1 contain a quadratic processing vulnerability in uFldNodeComms where each new node identity creates a ledger entry and triggers all-pai…

Published Sep 3, 2026 · updated Oct 14, 2026 · mit moos-ivp

MOOS-IvP versions through 24.8.1 contain a quadratic processing vulnerability in uFldNodeComms where each new node identity creates a ledger entry and triggers all-pairs distribution work. Attackers can supply unbounded distinct node names in reports to drive the shoreside broker into quadratic processing, delaying or preventing distribution of legitimate node reports.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Sep 3, 2026 · NIST NVD

    Detected

    MOOS-IvP versions through 24.8.1 contain a quadratic processing vulnerability in uFldNodeComms where each new node identity creates a ledger entry and triggers all-pairs distribution work. Attackers can supply unbounded distinct node names in reports to drive the shoreside broker into quadratic processing, delaying or preventing distribution of legitimate node reports.

  2. Oct 14, 2026 · NIST NVD

    Updated

    MOOS-IvP versions through 24.8.1 contain a quadratic processing vulnerability in uFldNodeComms where each new node identity creates a ledger entry and triggers all-pairs distribution work. Attackers can supply unbounded distinct node names in reports to drive the shoreside broker into quadratic processing, delaying or preventing distribution of legitimate node reports.

Affected

  • cpe mit/moos-ivpversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-85446

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-85446

    30-day exploitation probability 0.8%

    first.org
  • NIST NVDVulnerability recordCVE-2026-85446

    MOOS-IvP versions through 24.8.1 contain a quadratic processing vulnerability in uFldNodeComms where each new node identity creates a ledger entry and triggers all-pairs distribution work. Attackers can supply unbounded distinct node names in reports to drive the shoreside broker

    nvd.nist.gov

References