high7.5
CVE-2026-95845
Moquette is a lightweight Java MQTT broker.
Impact
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, the broker does not enforce a maximum length for pending per-session message queues. When a fast publisher sends messages to a slow subscriber whose in-flight window is full, queued messages can accumulate without bound in memory or persistent storage. Remote clients can use this condition to exhaust broker resources and cause a denial of service. This issue is fixed in version 0.18.1.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Moquette | Moquette | before 0.18.1 |