High severity · published Sep 23, 2026
CVE-2026-95845
Moquette unbounded per-session message queues allow memory exhaustion
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, the broker does not enforce a maximum length for pending per-session message queues. When a fast publisher sends messages to a slow subscriber whose in-flight window is full, queued messages can accumulate without bound in memory or persistent storage. Remote clients can use this condition to exhaust broker resources and cause a denial of service. This issue is fixed in version 0.18.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
moquette · moquette-io
< 0.18.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-95845
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-95845
Patch
https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba
Release Notes
https://github.com/moquette-io/moquette/releases/tag/v0.18.1
Exploit
https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq
More from moquette
9.6
CVE-2026-85724
Moquette pattern ACL wildcard injection allows cross-tenant authorization bypass
9.1
CVE-2026-95848
Moquette fails open when configured authentication or authorization classes cannot load
7.5
CVE-2026-95847
Moquette client IDs can cause cross-session H2 durable-queue corruption
7.5
CVE-2026-95846
Moquette publishes Last-Will messages without enforcing write authorization
7.5
CVE-2026-95844
Moquette deeply nested MQTT topics can cause stack exhaustion