A high-severity denial of service vulnerability in the Moquette MQTT broker allows unauthenticated attackers to crash critical event loops and disrupt communication for all co-located client sessions.

The vulnerability exists within the SessionEventLoop mechanism, where an uncaught exception during MQTT command processing causes the event loop to terminate without restarting. This flaw can be triggered by an unauthenticated attacker who sends specific MQTT commands to disrupt session processing for multiple clients simultaneously.

Successful exploitation of this flaw results in a complete denial of service for the affected MQTT broker, preventing legitimate devices from publishing or subscribing to messages. With a CVSS score of 8.7, this vulnerability poses a significant risk to industrial or IoT environments relying on real-time messaging, potentially leading to widespread operational downtime and loss of telemetry data.

Immediate Action: Upgrade the Moquette MQTT broker to version 0.18.1 or later to implement the necessary exception handling and event loop recovery mechanisms.

Proactive Monitoring: Review application logs for frequent connection drops or repetitive error messages related to SessionEventLoop failures, which may indicate an ongoing exploitation attempt.

Compensating Controls: Implement network-level rate limiting and traffic filtering to restrict access to the MQTT broker, ensuring only authorized clients can establish connections and send commands.

Public Exploit Available: No (There is no confirmed public exploit or weaponized code available in the provided data).

Given the ease of exploitation and the potential for widespread service disruption, administrators should prioritize patching this vulnerability immediately. Upgrading to version 0.18.1 is the only reliable way to ensure the stability of the MQTT event loop and protect against this denial of service vector.