Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, Moquette does not limit the depth of topic names and topic filters before processing them through recursive CTrie insertion and matching operations. A remote client can publish or subscribe with a deeply nested topic, causing a StackOverflowError that disrupts session processing and can deny service to broker clients. This issue is fixed in version 0.18.1.
References
| Link | Resource |
|---|---|
| https://github.com/moquette-io/moquette/commit/ca17e0be19e86d5e291f4532dfdc94616c8e0049 | Patch |
| https://github.com/moquette-io/moquette/releases/tag/v0.18.1 | Release Notes |
| https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq | Exploit Mitigation Vendor Advisory |
| https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq | Exploit Mitigation Vendor Advisory |
Configurations
History
29 Sep 2026, 02:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq - Exploit, Mitigation, Vendor Advisory |
28 Sep 2026, 15:23
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:moquette:moquette:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| First Time |
Moquette moquette
Moquette |
|
| References | () https://github.com/moquette-io/moquette/commit/ca17e0be19e86d5e291f4532dfdc94616c8e0049 - Patch | |
| References | () https://github.com/moquette-io/moquette/releases/tag/v0.18.1 - Release Notes | |
| References | () https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq - Exploit, Mitigation, Vendor Advisory |
23 Sep 2026, 17:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-09-23 17:17
Updated : 2026-09-29 02:16
NVD link : CVE-2026-95844
Mitre link : CVE-2026-95844
CVE.ORG link : CVE-2026-95844
JSON object : View
Products Affected
moquette
- moquette
CWE
CWE-674
Uncontrolled Recursion