High severity7.5NVD Advisory· Published Sep 23, 2026· Updated Sep 29, 2026
CVE-2026-95844
CVE-2026-95844
Description
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, Moquette does not limit the depth of topic names and topic filters before processing them through recursive CTrie insertion and matching operations. A remote client can publish or subscribe with a deeply nested topic, causing a StackOverflowError that disrupts session processing and can deny service to broker clients. This issue is fixed in version 0.18.1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: <0.18.1
Patches
Vulnerability mechanics
References
3- github.com/moquette-io/moquette/commit/ca17e0be19e86d5e291f4532dfdc94616c8e0049nvdPatch
- github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhqnvdExploitMitigationVendor Advisory
- github.com/moquette-io/moquette/releases/tag/v0.18.1nvdRelease Notes
News mentions
0No linked articles in our index yet.