CyberRota Analysis
AI-GeneratedMoquette, a lightweight Java MQTT broker, is vulnerable to a flaw that allows an attacker to disrupt session processing for all clients by exploiting uncaught exceptions in the event loop. This can lead to a denial of service, preventing clients from processing critical MQTT commands such as PUBLISH and SUBSCRIBE. Organizations using versions prior to 0.18.1 should prioritize upgrading to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, SessionEventLoop.run catches only InterruptedException, and SessionEventLoopGroup does not restart a terminated loop. An MQTT command that raises an uncaught exception can terminate an event loop shared by multiple client sessions, preventing every co-located client from processing PUBLISH, SUBSCRIBE, PUBACK, and other commands. An attacker can select client IDs that map across the available loops to disrupt session processing for the entire broker. This issue is fixed in version 0.18.1.
Related CVEs
Other vulnerabilities affecting the same vendor(s)