The vulnerability arises from the absence of a hard limit on the size of per‑session message queues in Moquette. When a fast publisher continues to send messages to a slow subscriber whose in‑flight window is already saturated, queued messages can accumulate without bound in memory or persistent storage. This uncontrolled growth allows an attacker to trigger a memory exhaustion or disk I/O overload, ultimately causing the broker to become unavailable or crash, leading to a denial‑of‑service condition.

This issue affects the Moquette MQTT broker distributed by moquette‑io, specifically all releases older than version 0.18.1; the vulnerability was addressed in the 0.18.1 release.

The vulnerability carries a CVSS score of 8.7, indicating a high severity. The exploit probability is not quantified by EPSS, and it is not listed in the CISA KEV catalog. The probable attack path involves a remote client acting as a high‑rate publisher to a target broker with a slower subscriber. If the publisher can send messages fast enough to keep the queue saturated, the broker’s resources will be gradually depleted, eventually leading to a denial of service. No specific authentication or privileged escalation is required; the attack can be initiated from any network reachable to the MQTT broker.