CVE-2026-95842
Received Received - Intake

Denial of Service in Moquette MQTT Broker

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, SessionEventLoop.run catches only InterruptedException, and SessionEventLoopGroup does not restart a terminated loop. An MQTT command that raises an uncaught exception can terminate an event loop shared by multiple client sessions, preventing every co-located client from processing PUBLISH, SUBSCRIBE, PUBACK, and other commands. An attacker can select client IDs that map across the available loops to disrupt session processing for the entire broker. This issue is fixed in version 0.18.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-95842
EUVD
EUVD-2026-85412

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
moquette moquette to 0.18.1 (exc)
moquette moquette to 0.18.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-248 An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a remote denial-of-service (DoS) vulnerability in the Moquette MQTT broker. It occurs when a command in the SessionEventLoop.run() method throws an exception, causing the shared session event loop to terminate. This loop handles multiple client sessions, so when it crashes, all clients bound to that loop can no longer process commands like PUBLISH, SUBSCRIBE, or PUBACK.

Detection Guidance

Monitor for unexpected termination of the Moquette MQTT broker process or event loop crashes. Check logs for exceptions in SessionEventLoop.run() or client session disconnections. Use network monitoring tools to detect abnormal client ID distributions or command processing failures.

Impact Analysis

An attacker could exploit this by distributing malicious client IDs across all available loops, effectively disabling session processing for the entire broker. This would prevent all co-located clients from sending or receiving MQTT commands, disrupting communication and operations dependent on the broker.

Compliance Impact

This vulnerability primarily causes a denial-of-service (DoS) condition by terminating shared event loops, disrupting MQTT command processing for multiple clients. While it does not directly expose data, prolonged broker downtime could impact systems handling sensitive data, potentially violating availability requirements in GDPR (Article 32) and HIPAA (Security Rule). However, no evidence suggests direct confidentiality or integrity breaches.

Mitigation Strategies

Upgrade Moquette to version 0.18.1 or later to apply the fix. If upgrading is not immediately possible, restrict network access to the MQTT broker and monitor for suspicious client behavior. Implement rate limiting and input validation for client commands.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-95842. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart