CVE-2026-95845 moquette-io CVE debrief

Who should care

Defenders responsible for Moquette deployments, especially those with high message throughput or large subscriber bases, should assess exposure and prioritize verification and remediation efforts.

Why it matters

CVE-2026-95845 is a high-severity vulnerability in Moquette, a lightweight Java MQTT broker. The issue allows remote clients to cause a denial-of-service by accumulating messages without bound in memory or persistent storage. Defenders responsible for Moquette deployments should assess exposure, verify their current version, and prioritize upgrading to version 0.18.1. Monitoring for unusual resource utilization and implementing rate limiting on publishers may also be prudent. The exact scope of affected deployments and potential impact on resource utilization require further verification.

• Resource exhaustion through unbounded message queue growth
• Potential for denial-of-service via broker resource depletion
• Need for verification of current Moquette version and exposure
• Priority on upgrading to version 0.18.1 for patched behavior

Technical summary

The Moquette MQTT broker does not enforce a maximum length for pending per-session message queues. This allows remote clients to cause a denial-of-service by accumulating messages without bound in memory or persistent storage when a fast publisher sends messages to a slow subscriber with a full in-flight window. Affected product deployments should verify their current version and upgrade to 0.18.1 if necessary. Monitoring for unusual resource utilization and implementing rate limiting on publishers may also be prudent.

Defensive priority

Defenders should prioritize verifying exposure of Moquette deployments, especially those with high message throughput or large subscriber bases. They should assess their current version and upgrade to 0.18.1 if necessary. Monitoring for unusual resource utilization and implementing rate limiting on publishers may also be prudent.

Recommended defensive actions

• Verify Moquette version and upgrade to 0.18.1 if necessary
• Monitor for unusual resource utilization in Moquette deployments
• Implement rate limiting on publishers to prevent message queue exhaustion
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. The vendor has released a patch in version 0.18.1. However, the exact scope of affected deployments and potential impact on resource utilization require further verification.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.