CVE-2026-95842: Moquette uncaught MQTT command exceptions can terminate shared session event loops
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, SessionEventLoop.run catches only InterruptedException, and SessionEventLoopGroup does not restart a terminated loop. An MQTT command that raises an uncaught exception can terminate an event loop shared by multiple client sessions, preventing every co-located client from processing PUBLISH, SUBSCRIBE, PUBACK, and other commands. An attacker can select client IDs that map across the available loops to disrupt session processing for the entire broker. This issue is fixed in version 0.18.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Moquetteto a version that resolves this vulnerability.Fixed in 0.18.1
Event History
Frequently Asked Questions
Which deployments are affected?
Eclipse Moquette deployments running versions before 0.18.1 are affected. The issue impacts shared session event loops, so disruption can extend beyond the attacker’s own client session to other clients assigned to the same loops.
What does an attacker need to do to cause disruption?
An attacker needs to send an MQTT command that raises an uncaught exception in a session event loop. They can select client IDs that map across the available loops, allowing disruption of session processing across the broker.
What is the operational impact of a terminated event loop?
Client sessions co-located on the terminated loop stop processing MQTT commands, including PUBLISH, SUBSCRIBE, and PUBACK. The event-loop group does not restart a terminated loop.
What should be done if the broker cannot be upgraded immediately?
The provided information identifies version 0.18.1 as the fix, but does not specify an interim mitigation. Prioritize upgrading affected Moquette instances to 0.18.1.