---
id: CVE-2026-95842
title: Moquette is a lightweight Java MQTT broker
summary: >-
  Moquette is a lightweight Java MQTT broker. Prior to 0.18.1,
  SessionEventLoop.run catches only InterruptedException, and
  SessionEventLoopGroup does not restart a terminated loop. An MQTT command that
  raises an uncaught exception can term…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-248
vendor: moquette
product: moquette
affected:
  - moquette < 0.18.1
patched:
  - moquette 0.18.1
published: '2026-09-23'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T13:34:50.467'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-95842'
references:
  - url: >-
      https://github.com/moquette-io/moquette/commit/86feb7c31e6fac849c465d8079d08c0e7ef01cdf
    label: security-advisories@github.com
  - url: 'https://github.com/moquette-io/moquette/pull/957'
    label: security-advisories@github.com
  - url: 'https://github.com/moquette-io/moquette/releases/tag/v0.18.1'
    label: security-advisories@github.com
  - url: >-
      https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq
    label: security-advisories@github.com
  - url: >-
      https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00382
epssPercentile: 0.29547
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-23T16:48:36.420367Z'
scores:
  nvd: 7.5
  cna: 8.7
ingestedAt: '2026-09-23T17:28:14.850Z'
---

## Overview

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, SessionEventLoop.run catches only InterruptedException, and SessionEventLoopGroup does not restart a terminated loop. An MQTT command that raises an uncaught exception can terminate an event loop shared by multiple client sessions, preventing every co-located client from processing PUBLISH, SUBSCRIBE, PUBACK, and other commands. An attacker can select client IDs that map across the available loops to disrupt session processing for the entire broker. This issue is fixed in version 0.18.1.

## Affected

- `moquette < 0.18.1`

## Remediation

Upgrade past the affected range:

- `moquette 0.18.1`