A vulnerability in the Moquette MQTT broker allows unauthenticated remote attackers to cause a denial of service by exhausting system resources through unbounded message queuing.

The application is susceptible to CWE-770, which involves the allocation of resources without limits. An unauthenticated remote attacker can exploit this by flooding the broker with messages to a slow subscriber, causing the system to accumulate unlimited data in memory or storage.

The exploitation of this vulnerability results in a denial of service, which can render the MQTT broker unresponsive to legitimate traffic. Given the CVSS score of 8.7, this represents a high-severity risk that could lead to significant operational downtime, particularly in IoT or messaging-heavy environments where real-time data transmission is critical.

Immediate Action: Update the moquette-io moquette broker to version 0.18.1 or later to implement the necessary message queue length enforcement.

Proactive Monitoring: Monitor system memory usage and disk storage growth on the MQTT broker, specifically looking for spikes that correlate with high message throughput from specific client connections.

Compensating Controls: Deploy rate limiting or traffic shaping at the network edge or via a reverse proxy to restrict the volume of messages sent by individual clients to the broker.

Public Exploit Available: No

This vulnerability presents a clear risk to service availability due to the lack of resource constraints on session queues. Administrators should prioritize upgrading to version 0.18.1 immediately to prevent potential denial of service attacks that could disrupt critical messaging infrastructure.