CVE-2026-95845 — Moquette unbounded per-session message queues allow memory exhaustion
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, the broker does not enforce a maximum length for pending per-session message queues. When a fast publisher sends mes…
Published: 2026-09-23 · CVSS: 8.7 · CVSS 4.0
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, the broker does not enforce a maximum length for pending per-session message queues. When a fast publisher sends messages to a slow subscriber whose in-flight window is full, queued messages can accumulate without bound in memory or persistent storage. Remote clients can use this condition to exhaust broker resources and cause a denial of service. This issue is fixed in version 0.18.1.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7