CVE-2026-95845highCWE-770

CVE-2026-95845: fallo de gravedad alta en moquette-io moquette

Moquette unbounded per-session message queues allow memory exhaustion

Publicada el

Seguir esta CVE+ Monitorear moquette+ Monitorear io.moquette:moquette-broker

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.7epss 0.4%
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, the broker does not enforce a maximum length for pending per-session message queues. When a fast publisher sends messages to a slow subscriber whose in-flight window is full, queued messages can accumulate without bound in memory or persistent storage. Remote clients can use this condition to exhaust broker resources and cause a denial of service. This issue is fixed in version 0.18.1.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Productos afectados
moquette-io · moquette
CVEs relacionadas — moquette-io moquette

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-85058HIGHMoquette: Missing Authorization in io.moquette:moquette-brokerEPSS 0.6%CVE-2026-95842HIGHMoquette uncaught MQTT command exceptions can terminate shared session event loopsEPSS 0.4%CVE-2026-95843HIGHMoquette malformed shared subscriptions can crash command processingEPSS 0.4%CVE-2026-95848CRITICALMoquette fails open when configured authentication or authorization classes cannot loadEPSS 0.4%CVE-2026-95844HIGHMoquette deeply nested MQTT topics can cause stack exhaustionEPSS 0.4%CVE-2026-95847HIGHMoquette client IDs can cause cross-session H2 durable-queue corruptionEPSS 0.3%