Description
MOOS-IvP uFldShoreBroker through 24.8.1 fails to limit the number of claimed communities stored in parallel vectors within ShoreBroker::handleMailNodePing(). A single publisher can supply unbounded distinct community names to grow retained state and per-pass work without limit, causing memory exhaustion and performance degradation.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
moos-ivp moos-ivp
Default version status: unaffected
0 to ≤ 24.8.1affected
References
- https://github.com/moos-ivp/moos-ivp/pull/133 ↗
- https://github.com/moos-ivp/moos-ivp/commit/2cbaed2227db31f50d5542cafe08445596800801 ↗
- https://github.com/moos-ivp/moos-ivp ↗
- https://github.com/moos-ivp/moos-ivp/blob/1de9ae146cd63c209e8c3fd81611a4ed2472971b/ivp/src/uFldShoreBroker/ShoreBroker.cpp#L124 ↗
- https://www.vulncheck.com/advisories/moos-ivp-through-24.8.1-ufldshorebroker-unbounded-community-state-retention ↗