A blocking receive call in MOOSCommServer::ListenLoop() causes the accept thread to wait indefinitely for data during the wire‑protocol handshake. If an attacker connects to the MOOSDB port and sends no data, the accept thread remains blocked while holding the socket‑list lock, preventing any subsequent client connections and effectively disabling the service. The weakness is identified as CWE‑400, a resource‑management issue leading to denial of service.

The vulnerability exists in the MOOS core‑moos middleware, specifically in versions up through 10.4.0. This includes the MOOSDB server component that accepts client connections on its designated TCP port.

The CVSS score of 8.7 indicates high severity. An unauthenticated attacker who can reach the MOOSDB port can trigger the flaw by connecting and sending no data, which blocks the accept thread indefinitely while holding the socket‑list lock, preventing subsequent client connections and effectively disabling the service. Because it requires no authentication or special privileges it is straightforward to exploit. The vulnerability is not yet listed in the CISA KEV catalog but may become a target due to widespread use of MOOS in autonomous robotic platforms.