{"cve":"CVE-2026-95845","enrichment":{"affected":[{"configurations":[{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"[0,0.18.1)"}}],"enrichment":{"confidence":100.0,"confidence_source":"matching","scores":[{"score":100.0,"source":"matching"}]},"original":{"product":"moquette","source":"cna","vendor":"moquette-io"},"product":"moquette","vendor":"moquette-io"}],"created":"2026-09-23T17:30:06.830161+00:00","updated":"2026-09-23T18:15:07.017514+00:00","vendors":["moquette-io","moquette-io$PRODUCT$moquette"]},"mitre":{"cpes":[],"created":"2026-09-23T16:29:51.402000+00:00","description":"Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, the broker does not enforce a maximum length for pending per-session message queues. When a fast publisher sends messages to a slow subscriber whose in-flight window is full, queued messages can accumulate without bound in memory or persistent storage. Remote clients can use this condition to exhaust broker resources and cause a denial of service. This issue is fixed in version 0.18.1.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{"score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}},"mitre_repo_path":"cves/2026/95xxx/CVE-2026-95845.json","references":["https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba","https://github.com/moquette-io/moquette/releases/tag/v0.18.1","https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq"],"title":"Moquette unbounded per-session message queues allow memory exhaustion","updated":"2026-09-23T19:44:31.486000+00:00","vendors":[],"weaknesses":["CWE-770"]},"nvd":{"cpes":[],"created":"2026-09-23T17:17:21.470000+00:00","description":"Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, the broker does not enforce a maximum length for pending per-session message queues. When a fast publisher sends messages to a slow subscriber whose in-flight window is full, queued messages can accumulate without bound in memory or persistent storage. Remote clients can use this condition to exhaust broker resources and cause a denial of service. This issue is fixed in version 0.18.1.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{"score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}},"nvd_repo_path":"2026/CVE-2026-95845.json","references":["https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba","https://github.com/moquette-io/moquette/releases/tag/v0.18.1","https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq"],"title":null,"updated":"2026-09-23T18:12:04.247000+00:00","vendors":[],"weaknesses":["CWE-770"]},"opencve":{"changes":[{"created":"2026-09-23T16:45:00+00:00","data":[{"details":{"new":"Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, the broker does not enforce a maximum length for pending per-session message queues. When a fast publisher sends messages to a slow subscriber whose in-flight window is full, queued messages can accumulate without bound in memory or persistent storage. Remote clients can use this condition to exhaust broker resources and cause a denial of service. This issue is fixed in version 0.18.1.","old":null},"type":"description"},{"details":{"new":"Moquette unbounded per-session message queues allow memory exhaustion","old":null},"type":"title"},{"details":{"added":["CWE-770"],"removed":[]},"type":"weaknesses"},{"details":{"added":["https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba","https://github.com/moquette-io/moquette/releases/tag/v0.18.1","https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq"],"removed":[]},"type":"references"},{"details":{"added":{"cvssV4_0":{"score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"563c1c99-0b2d-43ca-af23-def2913d2024"},{"created":"2026-09-23T18:30:00+00:00","data":[{"details":["moquette-io","moquette-io$PRODUCT$moquette"],"type":"first_time"},{"details":{"added":["moquette-io","moquette-io$PRODUCT$moquette"],"removed":[]},"type":"vendors"}],"id":"ffe89d03-f222-42e3-b48c-16abb5179119"}],"cpes":{"data":[],"providers":[]},"created":{"data":"2026-09-23T16:29:51.402000+00:00","provider":"mitre"},"description":{"data":"Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, the broker does not enforce a maximum length for pending per-session message queues. When a fast publisher sends messages to a slow subscriber whose in-flight window is full, queued messages can accumulate without bound in memory or persistent storage. Remote clients can use this condition to exhaust broker resources and cause a denial of service. This issue is fixed in version 0.18.1.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{},"provider":null},"cvssV4_0":{"data":{"score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},"provider":"mitre"},"epss":{"data":{},"provider":null},"kev":{"data":{},"provider":null},"ssvc":{"data":{},"provider":null},"threat_severity":{"data":null,"provider":null}},"references":{"data":["https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba","https://github.com/moquette-io/moquette/releases/tag/v0.18.1","https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq"],"providers":["mitre","nvd"]},"title":{"data":"Moquette unbounded per-session message queues allow memory exhaustion","provider":"mitre"},"updated":{"data":"2026-09-23T18:15:07.017514+00:00","provider":"enrichment"},"vendors":{"data":["moquette-io","moquette-io$PRODUCT$moquette"],"providers":["enrichment"]},"weaknesses":{"data":["CWE-770"],"providers":["mitre","nvd"]}}}