Moquette CVE-2026-95842

No special conditions beyond network reachability - remote unauthenticated exploitation works against default configurations of the Moquette broker, which accepts anonymous MQTT clients by default. The attacker only needs to send an MQTT command that raises an uncaught exception on a shared SessionEventLoop; concrete triggers named in the advisory include a malformed $share/grp SUBSCRIBE (StringIndexOutOfBoundsException), a deeply nested topic causing CTrie StackOverflowError, and an ACL NPE via an invalid client ID/filter. The main limiting factor is that impact is availability-only (no data exposure or code execution), and full broker-wide disruption requires selecting client IDs that distribute across all available event loops; deployments that disable anonymous access or restrict network exposure reduce reachability.

This is a genuine availability threat but not a code-execution or data-exposure issue. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) is internally consistent with the description: fully remote, low-complexity, no authentication (Moquette accepts anonymous clients by default), and impact is confined to availability (VA:H) with no confidentiality or integrity effect - which directly contradicts the input 'Information Disclosure' tag. The 8.7 score is high because CVSS 4.0 weights a network-reachable, unauthenticated, high-availability-impact flaw heavily; the real-world ceiling is a JVM memory-safe denial of service (the advisory explicitly disclaims RCE). No EPSS score is provided and there is no CISA KEV listing, so there is no evidence of widespread or automated exploitation; however, source-only proof-of-concept material and a regression test demonstrating the crash exist, and the trigger inputs (malformed $share SUBSCRIBE, deeply nested topics, ACL NPE) are described as trivially reachable. Net: treat as a real, easy-to-trigger DoS priority for anyone exposing a Moquette broker, but the absence of KEV/EPSS signals means it is not confirmed to be actively or widely exploited. The severity is a legitimate high for availability, not an overstated critical.

An unauthenticated attacker connects to an internet- or network-reachable Moquette broker (anonymous connections allowed by default) and sends a crafted MQTT command - such as a malformed $share/grp SUBSCRIBE or a deeply nested topic - that raises an uncaught Throwable inside a shared SessionEventLoop. Because the loop only catches InterruptedException and is never restarted, that thread wedges, halting PUBLISH/SUBSCRIBE/PUBACK processing for every co-located client; by choosing client IDs that hash across all loops the attacker can take down the entire broker. Source-level proof-of-concept and a demonstrating unit test exist, though no networked weaponized exploit or active exploitation is reported.