CVE-2026-95842 Overview
CVE-2026-95842 is a denial-of-service vulnerability in Moquette, a lightweight Java Message Queuing Telemetry Transport (MQTT) broker. Versions prior to 0.18.1 fail to handle unchecked exceptions inside the shared SessionEventLoop. The loop only catches InterruptedException, and SessionEventLoopGroup does not restart a terminated loop. A remote attacker can send an MQTT command that triggers an uncaught exception, terminating the loop and preventing every co-located client session from processing PUBLISH, SUBSCRIBE, PUBACK, and other commands. By choosing client IDs that map across all available loops, an attacker can disrupt session processing for the entire broker.
Critical Impact
An unauthenticated network attacker can terminate all session event loops and halt MQTT message processing across the broker.
Affected Products
- Moquette MQTT broker versions prior to 0.18.1
- Java applications embedding Moquette as an MQTT server library
- IoT and messaging deployments using Moquette for pub/sub processing
Discovery Timeline
- 2026-09-23 - CVE-2026-95842 published to the National Vulnerability Database
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-95842
Vulnerability Analysis
Moquette processes MQTT client commands using worker threads managed by SessionEventLoopGroup. Each SessionEventLoop thread services multiple client sessions that hash to the same loop index. The loop's run method wraps command execution in a try/catch block that only handles InterruptedException. Any other Throwable propagates out of the loop, terminating the thread. Because the group does not detect or restart a dead loop, every client session mapped to that thread is stranded. Subsequent PUBLISH, SUBSCRIBE, and acknowledgement commands from those clients are never dispatched.
The classification aligns with [CWE-248]: Uncaught Exception. The attacker does not need to bypass authentication to reach the vulnerable code path, and the impact scales with the number of client IDs an attacker can enumerate to cover each loop.
Root Cause
The root cause is missing Throwable handling in SessionEventLoop.run combined with the absence of a supervisor in SessionEventLoopGroup that restarts terminated workers. A single failing command is sufficient to remove a shared execution resource.
Attack Vector
An unauthenticated remote attacker connects to the MQTT broker and issues a crafted command that triggers an unchecked exception during processing. Repeating the attack with client IDs that hash to different loops takes down each event loop in turn, degrading and eventually halting message processing broker-wide.
} catch (InterruptedException e) {
LOG.info("SessionEventLoop {} interrupted", Thread.currentThread().getName());
Thread.currentThread().interrupt();
+ } catch (Throwable th) {
+ // Keep the shared loop alive on a failing command; the FutureTask already captured the
+ // failure for its submitter, so co-located sessions must not be taken down with it.
+ LOG.error("SessionEventLoop {} caught an unhandled error while processing a command; "
+ + "the loop continues", Thread.currentThread().getName(), th);
}
}
LOG.info("SessionEventLoop {} exit", Thread.currentThread().getName());
Source: Moquette commit 86feb7c — the patch adds a Throwable catch that keeps the shared loop alive after a failing command.
Detection Methods for CVE-2026-95842
Indicators of Compromise
- Log entries showing SessionEventLoop threads exiting unexpectedly with SessionEventLoop {name} exit messages under load.
- Sudden loss of PUBLISH, SUBSCRIBE, or PUBACK throughput for a subset of connected clients.
- Repeated MQTT CONNECT traffic from a single source using varied or algorithmically generated client IDs.
Detection Strategies
- Correlate broker thread lifecycle logs with per-client message-processing gaps to identify terminated event loops.
- Instrument the JVM with thread-count and thread-state metrics for SessionEventLoop workers; alert on unexpected thread termination.
- Track exceptions bubbling out of MQTT command handlers via application performance monitoring (APM) or structured logging.
Monitoring Recommendations
- Ingest broker application logs and JVM thread telemetry into a centralized SIEM or data lake for continuous analysis.
- Alert on client-ID enumeration patterns from single source IP addresses connecting to MQTT listener ports (default 1883/8883).
- Baseline normal per-client publish rates and flag sustained silences that follow broker-side exceptions.
How to Mitigate CVE-2026-95842
Immediate Actions Required
- Upgrade Moquette to version 0.18.1 or later, which contains the fix in SessionEventLoop.run.
- Restrict network exposure of MQTT listener ports to trusted clients using firewall rules or a reverse proxy.
- Enable authentication and access control on the broker to reduce the pool of attackers who can submit arbitrary commands.
Patch Information
The fix is available in Moquette release v0.18.1 and merged via pull request #957. Full technical details are published in the GHSA-5f42-97gr-vfhq security advisory. The patch adds a catch (Throwable th) block that logs the failure and keeps the shared event loop running.
Workarounds
- If immediate upgrade is not possible, place the broker behind a rate-limiting proxy that caps new CONNECT requests per source.
- Reduce co-location risk by increasing the size of the event loop group so individual failures affect fewer sessions.
- Add an external watchdog that restarts the broker process when SessionEventLoop threads terminate unexpectedly.
# Upgrade the Moquette dependency (Maven coordinates)
# In pom.xml, set the version to the patched release:
# <dependency>
# <groupId>io.moquette</groupId>
# <artifactId>moquette-broker</artifactId>
# <version>0.18.1</version>
# </dependency>
mvn versions:use-dep-version -Dincludes=io.moquette:moquette-broker -DdepVersion=0.18.1 -DforceVersion=true
mvn clean package
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
