MOOS‑IvP’s uFldShoreBroker component does not limit the number of community identifiers that publishers can claim; as a result, a broker that accepts many unique community names will grow its internal vectors without restraint, consuming increasing amounts of memory and degrading performance. The flaw is an unchecked resource consumption weakness classified as CWE‑770.

The vulnerability is present in MOOS‑IvP versions through 24.8.1, specifically within the ShoreBroker::handleMailNodePing routine in the uFldShoreBroker module. Any installation of MOOS‑IvP that accepts community name claims from publishers is susceptible. The issue does not affect later releases that have incorporated the patch or new releases after 24.8.1.

The CVSS score of 8.7 reflects a high severity. EPSS is not available, so current exploitation likelihood is unknown. The vulnerability is not listed in CISA KEV catalog. Based on the description, it is inferred that an attacker who can act as a publisher—either by connecting to the ShoreBroker over the network or by compromising a publisher—can send a crafted payload containing a large number of distinct community names, forcing the broker to allocate more memory than the host can provide and potentially causing the process to crash or the system to become unresponsive, effectively denying service to legitimate users.