Is CVE-2026-95842 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-95842 being exploited in the wild.

How severe is CVE-2026-95842?

High severity, with a CVSS score of 7.5, published 23 September 2026.

Is there a fix for CVE-2026-95842?

A patch was published on 2026-07-15: Fix merged in PR #957 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-95842 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-95842?

Check whether you run Moquette at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-95842: Moquette MQTT broker event loop denial of service

CVE-2026-95842 · Severity: high · CVSS 7.5 · Published 2026-09-23

Moquette is a lightweight MQTT broker used to handle real-time messaging for connected devices and applications. An attacker can craft malformed MQTT commands that trigger uncaught exceptions in the session event loop, causing the loop to terminate and blocking all clients routed to that loop from processing commands like PUBLISH and SUBSCRIBE. This results in a complete denial of service for a portion of the broker's clients.

Technologies: Moquette. Vendors: Moquette.

Quick answers

Is CVE-2026-95842 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-95842 being exploited in the wild.
How severe is CVE-2026-95842?: High severity, with a CVSS score of 7.5, published 23 September 2026.
Which products and versions are affected?: Moquette prior to 0.18.1.
Is there a fix for CVE-2026-95842?: A patch was published on 2026-07-15: Fix merged in PR #957 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-95842 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-95842?: Check whether you run Moquette at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

SessionEventLoop.run() fails to catch Throwable exceptions raised by command handlers, allowing uncaught exceptions to terminate the thread. Multiple client sessions are routed to the same event loop via hash-based assignment, so a single malformed MQTT packet can take down all co-located clients. An attacker can select client IDs that hash to all available loops to disable session processing broker-wide. The fix wraps per-command execution with Throwable handling to keep the loop alive.

Affected products

Moquette Moquette prior to 0.18.1

Timeline

2026-09-23: disclosed
2026-07-15: patched: Fix merged in PR #957

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.