Description
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, SessionEventLoop.run catches only InterruptedException, and SessionEventLoopGroup does not restart a terminated loop. An MQTT command that raises an uncaught exception can terminate an event loop shared by multiple client sessions, preventing every co-located client from processing PUBLISH, SUBSCRIBE, PUBACK, and other commands. An attacker can select client IDs that map across the available loops to disrupt session processing for the entire broker. This issue is fixed in version 0.18.1.
Published: 2026-09-23
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

Moquette is a lightweight Java MQTT broker; a bug in its event loop causes an uncaught exception to terminate the loop shared by all client sessions. This results in a denial of service for every client attached to the broker, as none can process PUBLISH, SUBSCRIBE, PUBACK or other commands. The flaw maps to CWE-248, describing an uncaught exception that results in a crash or denial of service.

Affected Systems

The vulnerability affects Moquette versions prior to 0.18.1, released by moquette-io:moquette. Any instance running an affected version is susceptible.

Risk and Exploitability

The CVSS score of 8.7 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, but the high CVSS suggests that attacks could be profitable. The likely attack vector is an attacker connecting to the broker and sending a crafted MQTT command that triggers the unhandled exception. Once the event loop stops, all clients sharing the loop are disrupted.

Generated by OpenCVE AI on September 23, 2026 at 17:24 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Moquette to version 0.18.1 or newer, which implements proper exception handling and restarts terminated loops.
  • If an upgrade cannot be performed immediately, isolate the broker from untrusted clients or use a reverse proxy to block malformed MQTT commands that could raise exceptions.
  • Review and adjust any custom MQTT command handling code to include comprehensive exception catching so that no unhandled exceptions can propagate and terminate the loop.

Generated by OpenCVE AI on September 23, 2026 at 17:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 23 Sep 2026 18:00:00 +0000

Type Values Removed Values Added
First Time appeared Moquette-io
Moquette-io moquette
Vendors & Products Moquette-io
Moquette-io moquette

Wed, 23 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 23 Sep 2026 16:45:00 +0000

Type Values Removed Values Added
Description Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, SessionEventLoop.run catches only InterruptedException, and SessionEventLoopGroup does not restart a terminated loop. An MQTT command that raises an uncaught exception can terminate an event loop shared by multiple client sessions, preventing every co-located client from processing PUBLISH, SUBSCRIBE, PUBACK, and other commands. An attacker can select client IDs that map across the available loops to disrupt session processing for the entire broker. This issue is fixed in version 0.18.1.
Title Moquette uncaught MQTT command exceptions can terminate shared session event loops
Weaknesses CWE-248
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Moquette-io Moquette
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-23T16:49:25.405Z

Reserved: 2026-09-22T16:39:45.793Z

Link: CVE-2026-95842

cve-icon Vulnrichment

Updated: 2026-09-23T16:48:51.362Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-23T17:17:20.970

Modified: 2026-09-23T18:12:04.247

Link: CVE-2026-95842

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-23T17:45:07Z

Weaknesses