Vulnerability Details CVE-2026-95844
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, Moquette does not limit the depth of topic names and topic filters before processing them through recursive CTrie insertion and matching operations. A remote client can publish or subscribe with a deeply nested topic, causing a StackOverflowError that disrupts session processing and can deny service to broker clients. This issue is fixed in version 0.18.1.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 19.5%
CVSS Severity
CVSS v3 Score 7.5
References
Products affected by CVE-2026-95844
-
cpe:2.3:a:moquette:moquette:0.10
-
cpe:2.3:a:moquette:moquette:0.11
-
cpe:2.3:a:moquette:moquette:0.12
-
cpe:2.3:a:moquette:moquette:0.12.1
-
cpe:2.3:a:moquette:moquette:0.13
-
cpe:2.3:a:moquette:moquette:0.14
-
cpe:2.3:a:moquette:moquette:0.14.1
-
cpe:2.3:a:moquette:moquette:0.14.2
-
cpe:2.3:a:moquette:moquette:0.14.3
-
cpe:2.3:a:moquette:moquette:0.15
-
cpe:2.3:a:moquette:moquette:0.15.1
-
cpe:2.3:a:moquette:moquette:0.15.2
-
cpe:2.3:a:moquette:moquette:0.16
-
cpe:2.3:a:moquette:moquette:0.17.0
-
cpe:2.3:a:moquette:moquette:0.18.0
-
cpe:2.3:a:moquette:moquette:0.7
-
cpe:2.3:a:moquette:moquette:0.8
-
cpe:2.3:a:moquette:moquette:0.8.1
-
cpe:2.3:a:moquette:moquette:0.9