CVE-2026-95845: Moquette unbounded per-session message queues allow memory exhaustion
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, the broker does not enforce a maximum length for pending per-session message queues. When a fast publisher sends messages to a slow subscriber whose in-flight window is full, queued messages can accumulate without bound in memory or persistent storage. Remote clients can use this condition to exhaust broker resources and cause a denial of service. This issue is fixed in version 0.18.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Moquetteto a version that resolves this vulnerability.Fixed in 0.18.1
Event History
Frequently Asked Questions
Who can trigger resource exhaustion?
A remote MQTT client can trigger the condition by publishing messages faster than a subscriber can consume them while that subscriber's in-flight window is full. Brokers serving slow or blocked subscribers are therefore exposed.
What resources can be exhausted?
Pending messages may accumulate without bound in memory or persistent storage. This can exhaust broker resources and cause a denial of service.
What versions are affected and how is the issue resolved?
Moquette versions before 0.18.1 are affected. Upgrade to version 0.18.1, which fixes the missing maximum length for pending per-session message queues.