CVE-2026-95845

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-95845
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-95845.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-95845
Aliases
Published
2026-09-23T16:29:51Z
Modified
2026-09-27T08:01:31Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Moquette unbounded per-session message queues allow memory exhaustion
Details

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, the broker does not enforce a maximum length for pending per-session message queues. When a fast publisher sends messages to a slow subscriber whose in-flight window is full, queued messages can accumulate without bound in memory or persistent storage. Remote clients can use this condition to exhaust broker resources and cause a denial of service. This issue is fixed in version 0.18.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/95xxx/CVE-2026-95845.json"
}
References

Affected packages

Git / github.com/moquette-io/moquette

Affected ranges

Type
GIT
Repo
https://github.com/moquette-io/moquette
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e8ce83336acce69d8e9c11c98805217aa156a16b
Fixed
2482cadfba44e615be704b892009a57ce06a1aba
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:moquette:moquette:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.18.1"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.18.0
0.7
Other
before_sofia2
last_gradle
last_osgi
last_with_maven
last_with_ringbuffer
second_try_with_osgi_giveup
v0.*
v0.10
v0.11
v0.12
v0.12.1
v0.18.0
v0.8
v0.9

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-95845.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "321339565367894361390229826575845660959",
            "length": 1022
        },
        "id": "CVE-2026-95845-158d0e1b",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba",
        "target": {
            "file": "broker/src/main/java/io/moquette/broker/Session.java",
            "function": "sendPublishInFlightWindowOrQueueing"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "176867168137621978667420767263752712841",
            "length": 1307
        },
        "id": "CVE-2026-95845-1de2742f",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba",
        "target": {
            "file": "broker/src/main/java/io/moquette/broker/unsafequeues/QueuePool.java",
            "function": "loadQueueDefinitions"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "74889972170141832345783998730325620459",
            "length": 1215
        },
        "id": "CVE-2026-95845-26a4ff10",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba",
        "target": {
            "file": "broker/src/main/java/io/moquette/broker/unsafequeues/QueuePool.java",
            "function": "close"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "331153489264899879476734528178243410998",
            "length": 193
        },
        "id": "CVE-2026-95845-3309b472",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba",
        "target": {
            "file": "broker/src/main/java/io/moquette/persistence/H2PersistentQueue.java",
            "function": "enqueue"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "44485533407302897460587027007544491459",
                "156089329690798081909507400382560738374",
                "253898886126499222003815915083768071292",
                "144763152029916740144162567906449210377",
                "89958587735232158065151620744870906037",
                "75981086016709819943838336149085024122",
                "165416656908838418776197930167128596604",
                "59417212556964126721638238486734238180",
                "271152105008648339485227269953311670307",
                "267833411293191953248419737706060851045",
                "224237689809842993748424925155771549330",
                "315287364671635773762524345092269242445",
                "50526145008754585137752223967543652363",
                "174987359367189086868373642716415335378",
                "209074694447674428038466979361272346238",
                "290654887006314940301212112858774166729",
                "42121722406962520780585916786710153137",
                "39803937782426342982039112568065788028",
                "27309096253799805212246138789062685872",
                "134308010911858491971284681074986751228",
                "189628670810857372459270372698596698095",
                "169519725617249485201896471877420656923",
                "123209097076055083531351037278996457642",
                "142034262386515272363397685712878129201"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-95845-36362777",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba",
        "target": {
            "file": "broker/src/main/java/io/moquette/broker/unsafequeues/Queue.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "61275047424702001552755557161967230197",
                "194693100961665250219225082344535313130"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-95845-431acf48",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba",
        "target": {
            "file": "broker/src/test/java/io/moquette/broker/unsafequeues/QueueTest.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "3381858892420548277970187275680616972",
            "length": 67
        },
        "id": "CVE-2026-95845-45f5680e",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba",
        "target": {
            "file": "broker/src/main/java/io/moquette/broker/InMemoryQueue.java",
            "function": "dequeue"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "188914402594701696626993301484733159899",
            "length": 1597
        },
        "id": "CVE-2026-95845-47d57f0b",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba",
        "target": {
            "file": "broker/src/main/java/io/moquette/broker/unsafequeues/Queue.java",
            "function": "enqueue"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "169224086629005416034555342036398388251",
                "58014565037777524255167328170029580163",
                "163031749301611899863231779854586664250",
                "329999680561794270573023587494026673632",
                "178182841096389528288773042529475485231",
                "235081363324842583625799518951121370097",
                "36661957383535543761020660998656103109",
                "129227586872463401810784602222814421924",
                "11313025120793926184928925515339012379",
                "20937764712753454920066462516460943881",
                "207826755593662401334055951463939086894",
                "66921837881761934255455198815680406725",
                "260103276551591091916231746477349555390",
                "329007493055916202399827326413766976412",
                "239095220314001165292360313967641836131",
                "92721353842900154164288003032548599233",
                "150946933298841976626556523811734136818",
                "250653340050992621080303631268547860899",
                "72894713779140226109902958797606367716",
                "68266272309086178401810390900879180771",
                "87922154873260765663056488574337720077",
                "63342838796631108468852555986643208234",
                "308052176792434556033497634507291584794"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-95845-4ec72e22",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba",
        "target": {
            "file": "broker/src/main/java/io/moquette/broker/unsafequeues/QueuePool.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "198882271507456015914533974044566677585",
                "8246114037799533457743186013709573812",
                "101699313938914673656785864568709792356",
                "2288429488776496490784607786450234976",
                "61332021490265594898723198416432940676",
                "9422120385933940169514664110961504100",
                "263226611493309858266933548825275334853",
                "235836922565470236513943468277344545092",
                "146684077098061612524131162578597983746",
                "18230634051693689479454596917630612945",
                "9301179694561616842667943832638024138",
                "234480183367640246840097673587826374554",
                "334784261265008831362247779404994582468",
                "119748996753600383435293493841210636325",
                "100246834941697490879865244435936954270"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-95845-5e5e913b",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba",
        "target": {
            "file": "broker/src/main/java/io/moquette/broker/InMemoryQueue.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "301986887015554298459390666357537590943",
            "length": 1578
        },
        "id": "CVE-2026-95845-9885b387",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba",
        "target": {
            "file": "broker/src/main/java/io/moquette/broker/unsafequeues/Queue.java",
            "function": "dequeue"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "5985490272015511716415044977976554284",
                "248029827012036856842886685965957901391",
                "68526090664037039765738801980263732939",
                "128901505576822827597578033876851800189",
                "213775932514864694581559961078908997871",
                "98262479907909863994948444432512042906",
                "95794411148124982899494432032872358778",
                "122434682981250596229197930385154473883",
                "31271732779486886467359822489403157170",
                "37424205292647360940650373990474810126",
                "15404363728820720483500320534262894560",
                "56255252747080049224669936809199111989",
                "69430660110231992802772863908618342195",
                "301241491336380522748413532549497837763",
                "86507214296812973819424443380381470175",
                "47705376471284863365674044735637910707",
                "307184071759434623098443736015446040379",
                "141253456124753538481900355648261389934",
                "19657352602350406181417331267915466038",
                "71026454591937040391097606217529438758",
                "213100314642398253919346696636683469233",
                "56540462016689581814495953213742968028",
                "85571055129005303213689919931858912217",
                "233835401684130493860752170109457355727"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-95845-9b0e37e9",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba",
        "target": {
            "file": "broker/src/main/java/io/moquette/persistence/SegmentPersistentQueue.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "28782716214036058856984744002766305636",
                "8572504479108718556984894357818032029",
                "61753469218477122001616877611546611563",
                "303912474277511605016211369890868669843"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-95845-a78b376d",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba",
        "target": {
            "file": "broker/src/main/java/io/moquette/BrokerConstants.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "54679800990750225378460553180378152913",
            "length": 424
        },
        "id": "CVE-2026-95845-a9f5f3af",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba",
        "target": {
            "file": "broker/src/main/java/io/moquette/persistence/SegmentPersistentQueue.java",
            "function": "dequeue"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "138459988591685333563257840597330326497",
            "length": 310
        },
        "id": "CVE-2026-95845-aa8a29dc",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba",
        "target": {
            "file": "broker/src/main/java/io/moquette/broker/unsafequeues/Queue.java",
            "function": "Queue"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "255381970200801952471233149858899161206",
                "110719305932422150769594891304969544171",
                "213912049421585643048301419071429382646",
                "239420527828989038953547073381165349370",
                "215579834323180995690194724279690318615"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-95845-d03a9fcb",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba",
        "target": {
            "file": "broker/src/main/java/io/moquette/broker/Session.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "193217712535750517361665419826077301870",
            "length": 84
        },
        "id": "CVE-2026-95845-dac5879d",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba",
        "target": {
            "file": "broker/src/main/java/io/moquette/broker/InMemoryQueue.java",
            "function": "enqueue"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "100439336406816283700578782509627907304",
                "70013413040884002204668852218461456813",
                "211887781413646558217277052822529807547",
                "248963203190541679574390862442235786033",
                "150551493242606100759021413579737464215",
                "136262207014484827066466900569439747263",
                "198452946388887820819694555531539559713",
                "8995376894903293293740032971963076807"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-95845-db66781e",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba",
        "target": {
            "file": "broker/src/main/java/io/moquette/persistence/H2PersistentQueue.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "264460424198365981025294149882277014898",
                "11410191927348774178838709852851310256",
                "273802157253247414129958982189405529275",
                "315296026132642631038163665576809441438"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-95845-dd85d397",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/moquette-io/moquette/commit/e8ce83336acce69d8e9c11c98805217aa156a16b",
        "target": {
            "file": "broker/src/main/java/io/moquette/broker/Server.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "124043094084192046145492927553376928405",
            "length": 254
        },
        "id": "CVE-2026-95845-f40681dc",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba",
        "target": {
            "file": "broker/src/main/java/io/moquette/persistence/SegmentPersistentQueue.java",
            "function": "enqueue"
        }
    }
]
vanir_signatures_modified 
"2026-09-27T08:01:31Z"