CVE-2026-95842

Moquette is a lightweight Java MQTT broker.

Moquette

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, SessionEventLoop.run catches only InterruptedException, and SessionEventLoopGroup does not restart a terminated loop. An MQTT command that raises an uncaught exception can terminate an event loop shared by multiple client sessions, preventing every co-located client from processing PUBLISH, SUBSCRIBE, PUBACK, and other commands. An attacker can select client IDs that map across the available loops to disrupt…

23. Sep 2026

Ausgewertete Quellen

• NVD
  CVE-2026-95842
• GitHub
  https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq