Event Loop Disruption Vulnerability in Moquette MQTT Broker

CVE-2026-95842

What is CVE-2026-95842?

Moquette, a lightweight Java MQTT broker, has a vulnerability that affects session processing within its event loop. Prior to version 0.18.1, the SessionEventLoop.run method was designed to catch only InterruptedException, leading to a scenario where an uncaught exception from an MQTT command could terminate the event loop. This situation impacts all client sessions sharing that loop, causing disruptions for operations such as PUBLISH, SUBSCRIBE, and PUBACK. Consequently, an attacker can exploit this by selecting specific client IDs to map to the compromised event loops, which can result in broader session processing issues across the entire broker. This critical issue has been addressed and fixed in version 0.18.1.

References