High severity · published Sep 23, 2026
CVE-2026-95844
Moquette deeply nested MQTT topics can cause stack exhaustion
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, Moquette does not limit the depth of topic names and topic filters before processing them through recursive CTrie insertion and matching operations. A remote client can publish or subscribe with a deeply nested topic, causing a StackOverflowError that disrupts session processing and can deny service to broker clients. This issue is fixed in version 0.18.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
moquette · moquette-io
< 0.18.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-95844
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-95844
x_refsource_CONFIRM
https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq
x_refsource_MISC
https://github.com/moquette-io/moquette/commit/ca17e0be19e86d5e291f4532dfdc94616c8e0049
x_refsource_MISC
https://github.com/moquette-io/moquette/releases/tag/v0.18.1
More from moquette
9.6
CVE-2026-85724
Moquette pattern ACL wildcard injection allows cross-tenant authorization bypass
9.1
CVE-2026-95848
Moquette fails open when configured authentication or authorization classes cannot load
7.5
CVE-2026-95847
Moquette client IDs can cause cross-session H2 durable-queue corruption
7.5
CVE-2026-95846
Moquette publishes Last-Will messages without enforcing write authorization
7.5
CVE-2026-95845
Moquette unbounded per-session message queues allow memory exhaustion