CVE-2026-95842

Name of the Vulnerable Software and Affected Versions Moquette versions prior to 0.18.1

Description In the SessionEventLoop.run() function, only InterruptedException is caught, and the SessionEventLoopGroup fails to restart a terminated loop. An MQTT command that triggers an uncaught exception can terminate an event loop shared by multiple client sessions. This prevents co-located clients from processing commands such as PUBLISH, SUBSCRIBE, and PUBACK. An attacker can manipulate client IDs to map across available loops and disrupt session processing for the entire broker.

Recommendations Update to version 0.18.1.