Moquette MQTT Broker CVE-2026-95845

Remote unauthenticated exploitation against default configurations of the Moquette MQTT broker, which permits anonymous clients by default. The concrete precondition is the messaging pattern itself: an attacker must sustain a fast publisher feeding a topic while a co-controlled (or victim) subscriber's QoS in-flight window stays full and its ACKs lag, so messages queue faster than they drain. No special feature flag is required, but exploitation is more damaging where durable/persistent session storage is enabled (adds disk exhaustion to memory exhaustion). Limiting factors: brokers configured to require authentication/ACLs restrict who can connect and publish, and network-isolated (non-internet-exposed) deployments reduce reachability; the pre-0.18.1 version constraint applies (fixed in 0.18.1, which caps queues at 32 elements).

The CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H, 8.7 HIGH) describes a purely availability-impacting flaw: network-reachable, low complexity, no privileges, no user interaction, with high availability impact and no confidentiality or integrity impact - consistent with CWE-770 (unbounded resource allocation). This is a genuine but bounded risk: it is a denial-of-service only, not RCE (the GHSA advisory explicitly states the ceiling on this memory-safe JVM is authz-bypass/DoS/integrity and disclaims any RCE). The 8.7 base score is high because Moquette is anonymous-by-default, making the exhaust-resources primitive reachable pre-authentication, but it produces no data compromise. No EPSS score, no CISA KEV listing, and no SSVC decision data were provided, so widespread or automated exploitation cannot be confirmed from the inputs. A source-only proof-of-concept cluster is referenced in the GHSA advisory, but the specific unbounded-queue DoS is described conceptually rather than as a weaponized network exploit. Net: a real, easy-to-trigger availability issue worth patching for internet-exposed brokers, but lacking the disclosure/integrity impact or confirmed active exploitation that would make it a top-tier emergency.

An attacker connects to an exposed Moquette broker (anonymous by default) as a fast publisher and also opens a slow-ACKing subscriber whose in-flight window fills up, then floods the subscribed topic. Because pre-0.18.1 imposes no cap on the pending per-session queue, messages accumulate without bound in heap memory or the durable H2/persistent store until the broker exhausts memory or disk and crashes. The GHSA advisory references source-only PoCs for the broader vulnerability cluster, but no networked, weaponized exploit for this specific queue-exhaustion issue is confirmed.