CVE-2026-95845
Undergoing Analysis Undergoing Analysis - In Progress

Denial of Service in Moquette MQTT Broker

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, the broker does not enforce a maximum length for pending per-session message queues. When a fast publisher sends messages to a slow subscriber whose in-flight window is full, queued messages can accumulate without bound in memory or persistent storage. Remote clients can use this condition to exhaust broker resources and cause a denial of service. This issue is fixed in version 0.18.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-24
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-95845
EUVD
EUVD-2026-85415

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
moquette-io moquette to 0.18.1 (exc)
moquette moquette to 0.18.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Moquette, a lightweight Java MQTT broker. It allows remote clients to send messages to a slow subscriber whose message queue is full, causing unbounded message accumulation in memory or storage. This can exhaust broker resources and lead to a denial of service.

Detection Guidance

Monitor Moquette broker memory usage and message queue sizes. Check for unbounded growth in pending messages for slow subscribers. Use MQTT client tools to simulate slow subscribers and observe queue behavior.

Impact Analysis

If you use Moquette versions before 0.18.1, attackers can exploit this flaw to overload your MQTT broker by sending excessive messages to slow subscribers. This may cause system crashes, service disruptions, or degraded performance for legitimate users.

Compliance Impact

The vulnerability allows resource exhaustion via unbounded message queues, which could lead to denial of service. This may impact availability requirements in GDPR (Article 32) and HIPAA (Security Rule §164.312(a)(2)(ii)), potentially causing non-compliance if systems fail to maintain availability of critical data processing.

Mitigation Strategies

Upgrade Moquette to version 0.18.1 or later to fix the unbounded message queue issue. Implement rate limiting for publishers and monitor subscriber in-flight windows to prevent resource exhaustion.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-95845. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart