{"id":"CVE-2026-95845","summary":"Moquette unbounded per-session message queues allow memory exhaustion","details":"Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, the broker does not enforce a maximum length for pending per-session message queues. When a fast publisher sends messages to a slow subscriber whose in-flight window is full, queued messages can accumulate without bound in memory or persistent storage. Remote clients can use this condition to exhaust broker resources and cause a denial of service. This issue is fixed in version 0.18.1.","aliases":["CVE-2026-85724","CVE-2026-95842","CVE-2026-95843","CVE-2026-95844","CVE-2026-95846","CVE-2026-95847","CVE-2026-95848","GHSA-5f42-97gr-vfhq"],"modified":"2026-09-27T08:01:31.599315Z","published":"2026-09-23T16:29:51.402Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-770"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/95xxx/CVE-2026-95845.json"},"references":[{"type":"WEB","url":"https://github.com/moquette-io/moquette/releases/tag/v0.18.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/95xxx/CVE-2026-95845.json"},{"type":"ADVISORY","url":"https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95845"},{"type":"FIX","url":"https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/moquette-io/moquette","events":[{"introduced":"0"},{"fixed":"e8ce83336acce69d8e9c11c98805217aa156a16b"},{"fixed":"2482cadfba44e615be704b892009a57ce06a1aba"}],"database_specific":{"cpe":"cpe:2.3:a:moquette:moquette:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"0.18.1"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v0.18.0","0.18.0","last_gradle","v0.12.1","v0.12","v0.11","second_try_with_osgi_giveup","last_with_maven","v0.10","before_sofia2","v0.9","v0.8","last_with_ringbuffer","0.7","last_osgi"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-95845.json","vanir_signatures_modified":"2026-09-27T08:01:31Z","vanir_signatures":[{"source":"https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba","target":{"file":"broker/src/main/java/io/moquette/broker/Session.java","function":"sendPublishInFlightWindowOrQueueing"},"deprecated":false,"digest":{"function_hash":"321339565367894361390229826575845660959","length":1022},"id":"CVE-2026-95845-158d0e1b","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba","target":{"file":"broker/src/main/java/io/moquette/broker/unsafequeues/QueuePool.java","function":"loadQueueDefinitions"},"deprecated":false,"digest":{"function_hash":"176867168137621978667420767263752712841","length":1307},"id":"CVE-2026-95845-1de2742f","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba","target":{"file":"broker/src/main/java/io/moquette/broker/unsafequeues/QueuePool.java","function":"close"},"deprecated":false,"digest":{"function_hash":"74889972170141832345783998730325620459","length":1215},"id":"CVE-2026-95845-26a4ff10","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba","target":{"file":"broker/src/main/java/io/moquette/persistence/H2PersistentQueue.java","function":"enqueue"},"deprecated":false,"digest":{"function_hash":"331153489264899879476734528178243410998","length":193},"id":"CVE-2026-95845-3309b472","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba","target":{"file":"broker/src/main/java/io/moquette/broker/unsafequeues/Queue.java"},"deprecated":false,"digest":{"line_hashes":["44485533407302897460587027007544491459","156089329690798081909507400382560738374","253898886126499222003815915083768071292","144763152029916740144162567906449210377","89958587735232158065151620744870906037","75981086016709819943838336149085024122","165416656908838418776197930167128596604","59417212556964126721638238486734238180","271152105008648339485227269953311670307","267833411293191953248419737706060851045","224237689809842993748424925155771549330","315287364671635773762524345092269242445","50526145008754585137752223967543652363","174987359367189086868373642716415335378","209074694447674428038466979361272346238","290654887006314940301212112858774166729","42121722406962520780585916786710153137","39803937782426342982039112568065788028","27309096253799805212246138789062685872","134308010911858491971284681074986751228","189628670810857372459270372698596698095","169519725617249485201896471877420656923","123209097076055083531351037278996457642","142034262386515272363397685712878129201"],"threshold":0.9},"id":"CVE-2026-95845-36362777","signature_type":"Line"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba","target":{"file":"broker/src/test/java/io/moquette/broker/unsafequeues/QueueTest.java"},"deprecated":false,"digest":{"line_hashes":["61275047424702001552755557161967230197","194693100961665250219225082344535313130"],"threshold":0.9},"id":"CVE-2026-95845-431acf48"},{"target":{"function":"dequeue","file":"broker/src/main/java/io/moquette/broker/InMemoryQueue.java"},"deprecated":false,"digest":{"function_hash":"3381858892420548277970187275680616972","length":67},"id":"CVE-2026-95845-45f5680e","signature_type":"Function","signature_version":"v1","source":"https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba"},{"source":"https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba","target":{"file":"broker/src/main/java/io/moquette/broker/unsafequeues/Queue.java","function":"enqueue"},"deprecated":false,"digest":{"function_hash":"188914402594701696626993301484733159899","length":1597},"id":"CVE-2026-95845-47d57f0b","signature_type":"Function","signature_version":"v1"},{"target":{"file":"broker/src/main/java/io/moquette/broker/unsafequeues/QueuePool.java"},"deprecated":false,"digest":{"line_hashes":["169224086629005416034555342036398388251","58014565037777524255167328170029580163","163031749301611899863231779854586664250","329999680561794270573023587494026673632","178182841096389528288773042529475485231","235081363324842583625799518951121370097","36661957383535543761020660998656103109","129227586872463401810784602222814421924","11313025120793926184928925515339012379","20937764712753454920066462516460943881","207826755593662401334055951463939086894","66921837881761934255455198815680406725","260103276551591091916231746477349555390","329007493055916202399827326413766976412","239095220314001165292360313967641836131","92721353842900154164288003032548599233","150946933298841976626556523811734136818","250653340050992621080303631268547860899","72894713779140226109902958797606367716","68266272309086178401810390900879180771","87922154873260765663056488574337720077","63342838796631108468852555986643208234","308052176792434556033497634507291584794"],"threshold":0.9},"id":"CVE-2026-95845-4ec72e22","signature_type":"Line","signature_version":"v1","source":"https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba"},{"target":{"file":"broker/src/main/java/io/moquette/broker/InMemoryQueue.java"},"deprecated":false,"digest":{"line_hashes":["198882271507456015914533974044566677585","8246114037799533457743186013709573812","101699313938914673656785864568709792356","2288429488776496490784607786450234976","61332021490265594898723198416432940676","9422120385933940169514664110961504100","263226611493309858266933548825275334853","235836922565470236513943468277344545092","146684077098061612524131162578597983746","18230634051693689479454596917630612945","9301179694561616842667943832638024138","234480183367640246840097673587826374554","334784261265008831362247779404994582468","119748996753600383435293493841210636325","100246834941697490879865244435936954270"],"threshold":0.9},"id":"CVE-2026-95845-5e5e913b","signature_type":"Line","signature_version":"v1","source":"https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba"},{"source":"https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba","target":{"file":"broker/src/main/java/io/moquette/broker/unsafequeues/Queue.java","function":"dequeue"},"deprecated":false,"digest":{"function_hash":"301986887015554298459390666357537590943","length":1578},"id":"CVE-2026-95845-9885b387","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-95845-9b0e37e9","signature_type":"Line","signature_version":"v1","source":"https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba","target":{"file":"broker/src/main/java/io/moquette/persistence/SegmentPersistentQueue.java"},"deprecated":false,"digest":{"line_hashes":["5985490272015511716415044977976554284","248029827012036856842886685965957901391","68526090664037039765738801980263732939","128901505576822827597578033876851800189","213775932514864694581559961078908997871","98262479907909863994948444432512042906","95794411148124982899494432032872358778","122434682981250596229197930385154473883","31271732779486886467359822489403157170","37424205292647360940650373990474810126","15404363728820720483500320534262894560","56255252747080049224669936809199111989","69430660110231992802772863908618342195","301241491336380522748413532549497837763","86507214296812973819424443380381470175","47705376471284863365674044735637910707","307184071759434623098443736015446040379","141253456124753538481900355648261389934","19657352602350406181417331267915466038","71026454591937040391097606217529438758","213100314642398253919346696636683469233","56540462016689581814495953213742968028","85571055129005303213689919931858912217","233835401684130493860752170109457355727"],"threshold":0.9}},{"deprecated":false,"digest":{"line_hashes":["28782716214036058856984744002766305636","8572504479108718556984894357818032029","61753469218477122001616877611546611563","303912474277511605016211369890868669843"],"threshold":0.9},"id":"CVE-2026-95845-a78b376d","signature_type":"Line","signature_version":"v1","source":"https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba","target":{"file":"broker/src/main/java/io/moquette/BrokerConstants.java"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba","target":{"file":"broker/src/main/java/io/moquette/persistence/SegmentPersistentQueue.java","function":"dequeue"},"deprecated":false,"digest":{"function_hash":"54679800990750225378460553180378152913","length":424},"id":"CVE-2026-95845-a9f5f3af"},{"source":"https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba","target":{"file":"broker/src/main/java/io/moquette/broker/unsafequeues/Queue.java","function":"Queue"},"deprecated":false,"digest":{"function_hash":"138459988591685333563257840597330326497","length":310},"id":"CVE-2026-95845-aa8a29dc","signature_type":"Function","signature_version":"v1"},{"digest":{"line_hashes":["255381970200801952471233149858899161206","110719305932422150769594891304969544171","213912049421585643048301419071429382646","239420527828989038953547073381165349370","215579834323180995690194724279690318615"],"threshold":0.9},"id":"CVE-2026-95845-d03a9fcb","signature_type":"Line","signature_version":"v1","source":"https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba","target":{"file":"broker/src/main/java/io/moquette/broker/Session.java"},"deprecated":false},{"digest":{"function_hash":"193217712535750517361665419826077301870","length":84},"id":"CVE-2026-95845-dac5879d","signature_type":"Function","signature_version":"v1","source":"https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba","target":{"file":"broker/src/main/java/io/moquette/broker/InMemoryQueue.java","function":"enqueue"},"deprecated":false},{"id":"CVE-2026-95845-db66781e","signature_type":"Line","signature_version":"v1","source":"https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba","target":{"file":"broker/src/main/java/io/moquette/persistence/H2PersistentQueue.java"},"deprecated":false,"digest":{"line_hashes":["100439336406816283700578782509627907304","70013413040884002204668852218461456813","211887781413646558217277052822529807547","248963203190541679574390862442235786033","150551493242606100759021413579737464215","136262207014484827066466900569439747263","198452946388887820819694555531539559713","8995376894903293293740032971963076807"],"threshold":0.9}},{"target":{"file":"broker/src/main/java/io/moquette/broker/Server.java"},"deprecated":false,"digest":{"line_hashes":["264460424198365981025294149882277014898","11410191927348774178838709852851310256","273802157253247414129958982189405529275","315296026132642631038163665576809441438"],"threshold":0.9},"id":"CVE-2026-95845-dd85d397","signature_type":"Line","signature_version":"v1","source":"https://github.com/moquette-io/moquette/commit/e8ce83336acce69d8e9c11c98805217aa156a16b"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba","target":{"file":"broker/src/main/java/io/moquette/persistence/SegmentPersistentQueue.java","function":"enqueue"},"deprecated":false,"digest":{"function_hash":"124043094084192046145492927553376928405","length":254},"id":"CVE-2026-95845-f40681dc"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}