CVE-2026-95842 Details
Description
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, SessionEventLoop.run catches only InterruptedException, and SessionEventLoopGroup does not restart a terminated loop. An MQTT command that raises an uncaught exception can terminate an event loop shared by multiple client sessions, preventing every co-located client from processing PUBLISH, SUBSCRIBE, PUBACK, and other commands. An attacker can select client IDs that map across the available loops to disrupt session processing for the entire broker. This issue is fixed in version 0.18.1.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Sep 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/moquette-io/moquette/commit/86feb7c31e6fac849c465d8079d08c0e7ef01cdf | [email protected] | Patch |
| https://github.com/moquette-io/moquette/pull/957 | [email protected] | Patch |
| https://github.com/moquette-io/moquette/releases/tag/v0.18.1 | [email protected] | Release Notes |
| https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-248 | Uncaught Exception | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| moquette moquette | < 0.18.1 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 25, 2026 | Initial Analysis | [email protected] |
| Sep 23, 2026 | New CVE Received | [email protected] |
| Sep 23, 2026 | CVE Modified | CISA-ADP |