Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-95848 (GCVE-0-2026-95848)

Vulnerability from nvd – Published: 2026-09-23 16:29 – Updated: 2026-09-23 17:58

Title

Moquette fails open when configured authentication or authorization classes cannot load

Summary

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured authenticator or authorizator class cannot be loaded, Server.initializeAuthenticator and Server.initializeAuthorizatorPolicy treat the failure as though no custom class was configured and fall back to AcceptAllAuthenticator or PermitAllAuthorizatorPolicy. A misspelled class name, missing dependency, constructor failure, or classpath problem can therefore start the broker with authentication or authorization disabled even though the operator configured those controls. This issue is fixed in version 0.18.1.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-23 17:58 UTC

CWE

CWE-636 - Not Failing Securely ('Failing Open')

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/moquette-io/moquette/security/…	x_refsource_CONFIRM
https://github.com/moquette-io/moquette/pull/967	x_refsource_MISC
https://github.com/moquette-io/moquette/commit/14…	x_refsource_MISC
https://github.com/moquette-io/moquette/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
moquette-io	moquette	Affected: < 0.18.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-95848",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T17:58:35.511233Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T17:58:59.375Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "moquette",
          "vendor": "moquette-io",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.18.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured authenticator or authorizator class cannot be loaded, Server.initializeAuthenticator and Server.initializeAuthorizatorPolicy treat the failure as though no custom class was configured and fall back to AcceptAllAuthenticator or PermitAllAuthorizatorPolicy. A misspelled class name, missing dependency, constructor failure, or classpath problem can therefore start the broker with authentication or authorization disabled even though the operator configured those controls. This issue is fixed in version 0.18.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-636",
              "description": "CWE-636: Not Failing Securely (\u0027Failing Open\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T16:29:58.300Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq"
        },
        {
          "name": "https://github.com/moquette-io/moquette/pull/967",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/pull/967"
        },
        {
          "name": "https://github.com/moquette-io/moquette/commit/14a2f4fd280c8f6a791600c306cbccecb7c67007",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/commit/14a2f4fd280c8f6a791600c306cbccecb7c67007"
        },
        {
          "name": "https://github.com/moquette-io/moquette/releases/tag/v0.18.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/releases/tag/v0.18.1"
        }
      ],
      "source": {
        "advisory": "GHSA-h285-r7h3-gfjg",
        "discovery": "UNKNOWN"
      },
      "title": "Moquette fails open when configured authentication or authorization classes cannot load"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-95848",
    "datePublished": "2026-09-23T16:29:58.300Z",
    "dateReserved": "2026-09-22T16:39:45.794Z",
    "dateUpdated": "2026-09-23T17:58:59.375Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-95847 (GCVE-0-2026-95847)

Vulnerability from nvd – Published: 2026-09-23 16:29 – Updated: 2026-09-23 16:50

Title

Moquette client IDs can cause cross-session H2 durable-queue corruption

Summary

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, H2PersistentQueue derives a session's message-map name as queue_ plus the client ID and its metadata-map name as queue_ plus the client ID plus _meta. A durable session whose client ID ends in _meta can therefore make its message map collide with another client's metadata map. The colliding sessions read and write the same H2 MVStore map with incompatible value types, which can corrupt queue head and tail data and cause message loss, misdelivery, failed queue reloads, or exposure of queued content across sessions. This issue is fixed in version 0.18.1.

Severity

8.8 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-23 16:50 UTC

CWE

CWE-99 - Improper Control of Resource Identifiers ('Resource Injection')

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/moquette-io/moquette/security/…	x_refsource_CONFIRM
https://github.com/moquette-io/moquette/pull/964	x_refsource_MISC
https://github.com/moquette-io/moquette/commit/72…	x_refsource_MISC
https://github.com/moquette-io/moquette/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
moquette-io	moquette	Affected: < 0.18.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-95847",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T16:50:06.329970Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T16:50:25.152Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "moquette",
          "vendor": "moquette-io",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.18.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, H2PersistentQueue derives a session\u0027s message-map name as queue_ plus the client ID and its metadata-map name as queue_ plus the client ID plus _meta. A durable session whose client ID ends in _meta can therefore make its message map collide with another client\u0027s metadata map. The colliding sessions read and write the same H2 MVStore map with incompatible value types, which can corrupt queue head and tail data and cause message loss, misdelivery, failed queue reloads, or exposure of queued content across sessions. This issue is fixed in version 0.18.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-99",
              "description": "CWE-99: Improper Control of Resource Identifiers (\u0027Resource Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T16:29:56.125Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq"
        },
        {
          "name": "https://github.com/moquette-io/moquette/pull/964",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/pull/964"
        },
        {
          "name": "https://github.com/moquette-io/moquette/commit/72d6c8257191d2e4b2e3aa11ab25fd09f88c6cb7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/commit/72d6c8257191d2e4b2e3aa11ab25fd09f88c6cb7"
        },
        {
          "name": "https://github.com/moquette-io/moquette/releases/tag/v0.18.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/releases/tag/v0.18.1"
        }
      ],
      "source": {
        "advisory": "GHSA-xx3c-pm46-jg78",
        "discovery": "UNKNOWN"
      },
      "title": "Moquette client IDs can cause cross-session H2 durable-queue corruption"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-95847",
    "datePublished": "2026-09-23T16:29:56.125Z",
    "dateReserved": "2026-09-22T16:39:45.794Z",
    "dateUpdated": "2026-09-23T16:50:25.152Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-95846 (GCVE-0-2026-95846)

Vulnerability from nvd – Published: 2026-09-23 16:29 – Updated: 2026-09-23 16:29

Title

Moquette publishes Last-Will messages without enforcing write authorization

Summary

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will message without applying the canWrite authorization and reserved-topic checks used for a normal PUBLISH. A client can configure a Will for a topic that the client is not permitted to write and cause the broker to publish the unauthorized message when the client disconnects unexpectedly. This issue allows unauthorized message injection into restricted topics. This issue is fixed in version 0.18.1.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/moquette-io/moquette/security/…	x_refsource_CONFIRM
https://github.com/moquette-io/moquette/commit/f5…	x_refsource_MISC
https://github.com/moquette-io/moquette/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
moquette-io	moquette	Affected: < 0.18.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "moquette",
          "vendor": "moquette-io",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.18.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client\u0027s Last-Will message without applying the canWrite authorization and reserved-topic checks used for a normal PUBLISH. A client can configure a Will for a topic that the client is not permitted to write and cause the broker to publish the unauthorized message when the client disconnects unexpectedly. This issue allows unauthorized message injection into restricted topics. This issue is fixed in version 0.18.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T16:29:54.130Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq"
        },
        {
          "name": "https://github.com/moquette-io/moquette/commit/f5a323fe782d1505c0097498cb22eb6ec6c96973",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/commit/f5a323fe782d1505c0097498cb22eb6ec6c96973"
        },
        {
          "name": "https://github.com/moquette-io/moquette/releases/tag/v0.18.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/releases/tag/v0.18.1"
        }
      ],
      "source": {
        "advisory": "GHSA-3rhq-5crp-9w5f",
        "discovery": "UNKNOWN"
      },
      "title": "Moquette publishes Last-Will messages without enforcing write authorization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-95846",
    "datePublished": "2026-09-23T16:29:54.130Z",
    "dateReserved": "2026-09-22T16:39:45.793Z",
    "dateUpdated": "2026-09-23T16:29:54.130Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-95845 (GCVE-0-2026-95845)

Vulnerability from nvd – Published: 2026-09-23 16:29 – Updated: 2026-09-23 19:44

Title

Moquette unbounded per-session message queues allow memory exhaustion

Summary

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, the broker does not enforce a maximum length for pending per-session message queues. When a fast publisher sends messages to a slow subscriber whose in-flight window is full, queued messages can accumulate without bound in memory or persistent storage. Remote clients can use this condition to exhaust broker resources and cause a denial of service. This issue is fixed in version 0.18.1.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-23 18:06 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/moquette-io/moquette/security/…	x_refsource_CONFIRM
https://github.com/moquette-io/moquette/commit/24…	x_refsource_MISC
https://github.com/moquette-io/moquette/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
moquette-io	moquette	Affected: < 0.18.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-95845",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T18:06:26.358093Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T19:44:31.486Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "moquette",
          "vendor": "moquette-io",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.18.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, the broker does not enforce a maximum length for pending per-session message queues. When a fast publisher sends messages to a slow subscriber whose in-flight window is full, queued messages can accumulate without bound in memory or persistent storage. Remote clients can use this condition to exhaust broker resources and cause a denial of service. This issue is fixed in version 0.18.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T16:29:51.402Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq"
        },
        {
          "name": "https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba"
        },
        {
          "name": "https://github.com/moquette-io/moquette/releases/tag/v0.18.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/releases/tag/v0.18.1"
        }
      ],
      "source": {
        "advisory": "GHSA-f9rr-rg42-xc8x",
        "discovery": "UNKNOWN"
      },
      "title": "Moquette unbounded per-session message queues allow memory exhaustion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-95845",
    "datePublished": "2026-09-23T16:29:51.402Z",
    "dateReserved": "2026-09-22T16:39:45.793Z",
    "dateUpdated": "2026-09-23T19:44:31.486Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-95844 (GCVE-0-2026-95844)

Vulnerability from nvd – Published: 2026-09-23 16:29 – Updated: 2026-09-23 16:29

Title

Moquette deeply nested MQTT topics can cause stack exhaustion

Summary

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, Moquette does not limit the depth of topic names and topic filters before processing them through recursive CTrie insertion and matching operations. A remote client can publish or subscribe with a deeply nested topic, causing a StackOverflowError that disrupts session processing and can deny service to broker clients. This issue is fixed in version 0.18.1.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CWE

CWE-674 - Uncontrolled Recursion

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/moquette-io/moquette/security/…	x_refsource_CONFIRM
https://github.com/moquette-io/moquette/commit/ca…	x_refsource_MISC
https://github.com/moquette-io/moquette/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
moquette-io	moquette	Affected: < 0.18.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "moquette",
          "vendor": "moquette-io",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.18.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, Moquette does not limit the depth of topic names and topic filters before processing them through recursive CTrie insertion and matching operations. A remote client can publish or subscribe with a deeply nested topic, causing a StackOverflowError that disrupts session processing and can deny service to broker clients. This issue is fixed in version 0.18.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T16:29:49.416Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq"
        },
        {
          "name": "https://github.com/moquette-io/moquette/commit/ca17e0be19e86d5e291f4532dfdc94616c8e0049",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/commit/ca17e0be19e86d5e291f4532dfdc94616c8e0049"
        },
        {
          "name": "https://github.com/moquette-io/moquette/releases/tag/v0.18.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/releases/tag/v0.18.1"
        }
      ],
      "source": {
        "advisory": "GHSA-446h-6w49-5x92",
        "discovery": "UNKNOWN"
      },
      "title": "Moquette deeply nested MQTT topics can cause stack exhaustion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-95844",
    "datePublished": "2026-09-23T16:29:49.416Z",
    "dateReserved": "2026-09-22T16:39:45.793Z",
    "dateUpdated": "2026-09-23T16:29:49.416Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-95843 (GCVE-0-2026-95843)

Vulnerability from nvd – Published: 2026-09-23 16:29 – Updated: 2026-09-23 17:58

Title

Moquette malformed shared subscriptions can crash command processing

Summary

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.subscribe parses a shared-subscription filter through SharedSubscriptionUtils.extractShareName before validating the complete $share/{shareName}/{topicFilter} structure. A remote client can send a filter such as $share/grp without a topic-filter portion, causing a StringIndexOutOfBoundsException while calculating the share name. The exception terminates command handling on the shared session event loop and can deny service to other client sessions assigned to that loop. This issue is fixed in version 0.18.1.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-23 17:57 UTC

CWE

CWE-20 - Improper Input Validation

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/moquette-io/moquette/security/…	x_refsource_CONFIRM
https://github.com/moquette-io/moquette/pull/962	x_refsource_MISC
https://github.com/moquette-io/moquette/commit/af…	x_refsource_MISC
https://github.com/moquette-io/moquette/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
moquette-io	moquette	Affected: < 0.18.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-95843",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T17:57:47.160479Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T17:58:06.940Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "moquette",
          "vendor": "moquette-io",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.18.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.subscribe parses a shared-subscription filter through SharedSubscriptionUtils.extractShareName before validating the complete $share/{shareName}/{topicFilter} structure. A remote client can send a filter such as $share/grp without a topic-filter portion, causing a StringIndexOutOfBoundsException while calculating the share name. The exception terminates command handling on the shared session event loop and can deny service to other client sessions assigned to that loop. This issue is fixed in version 0.18.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T16:29:44.588Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq"
        },
        {
          "name": "https://github.com/moquette-io/moquette/pull/962",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/pull/962"
        },
        {
          "name": "https://github.com/moquette-io/moquette/commit/affdc71fdba92dc020421678970ae70518fb6da2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/commit/affdc71fdba92dc020421678970ae70518fb6da2"
        },
        {
          "name": "https://github.com/moquette-io/moquette/releases/tag/v0.18.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/releases/tag/v0.18.1"
        }
      ],
      "source": {
        "advisory": "GHSA-56p9-97wj-c789",
        "discovery": "UNKNOWN"
      },
      "title": "Moquette malformed shared subscriptions can crash command processing"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-95843",
    "datePublished": "2026-09-23T16:29:44.588Z",
    "dateReserved": "2026-09-22T16:39:45.793Z",
    "dateUpdated": "2026-09-23T17:58:06.940Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-95842 (GCVE-0-2026-95842)

Vulnerability from nvd – Published: 2026-09-23 16:29 – Updated: 2026-09-23 16:49

Title

Moquette uncaught MQTT command exceptions can terminate shared session event loops

Summary

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, SessionEventLoop.run catches only InterruptedException, and SessionEventLoopGroup does not restart a terminated loop. An MQTT command that raises an uncaught exception can terminate an event loop shared by multiple client sessions, preventing every co-located client from processing PUBLISH, SUBSCRIBE, PUBACK, and other commands. An attacker can select client IDs that map across the available loops to disrupt session processing for the entire broker. This issue is fixed in version 0.18.1.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-23 16:48 UTC

CWE

CWE-248 - Uncaught Exception

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/moquette-io/moquette/security/…	x_refsource_CONFIRM
https://github.com/moquette-io/moquette/pull/957	x_refsource_MISC
https://github.com/moquette-io/moquette/commit/86…	x_refsource_MISC
https://github.com/moquette-io/moquette/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
moquette-io	moquette	Affected: < 0.18.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-95842",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T16:48:36.420367Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T16:49:25.405Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "moquette",
          "vendor": "moquette-io",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.18.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, SessionEventLoop.run catches only InterruptedException, and SessionEventLoopGroup does not restart a terminated loop. An MQTT command that raises an uncaught exception can terminate an event loop shared by multiple client sessions, preventing every co-located client from processing PUBLISH, SUBSCRIBE, PUBACK, and other commands. An attacker can select client IDs that map across the available loops to disrupt session processing for the entire broker. This issue is fixed in version 0.18.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "CWE-248: Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T16:29:41.744Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq"
        },
        {
          "name": "https://github.com/moquette-io/moquette/pull/957",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/pull/957"
        },
        {
          "name": "https://github.com/moquette-io/moquette/commit/86feb7c31e6fac849c465d8079d08c0e7ef01cdf",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/commit/86feb7c31e6fac849c465d8079d08c0e7ef01cdf"
        },
        {
          "name": "https://github.com/moquette-io/moquette/releases/tag/v0.18.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/releases/tag/v0.18.1"
        }
      ],
      "source": {
        "advisory": "GHSA-pqwr-fmcp-mjq7",
        "discovery": "UNKNOWN"
      },
      "title": "Moquette uncaught MQTT command exceptions can terminate shared session event loops"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-95842",
    "datePublished": "2026-09-23T16:29:41.744Z",
    "dateReserved": "2026-09-22T16:39:45.793Z",
    "dateUpdated": "2026-09-23T16:49:25.405Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-85724 (GCVE-0-2026-85724)

Vulnerability from nvd – Published: 2026-09-23 16:29 – Updated: 2026-09-23 16:29

Title

Moquette pattern ACL wildcard injection allows cross-tenant authorization bypass

Summary

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username values directly into rules containing %c or %u and then treats the result as an MQTT topic filter. A client that uses + or # in either identity can broaden the substituted filter and gain cross-tenant read and write access. A # identity can also produce an invalid filter that triggers a NullPointerException in Topic.match and disrupts session processing. This issue is fixed in version 0.18.1.

Severity

9.6 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

CWE

CWE-863 - Incorrect Authorization
CWE-155 - Improper Neutralization of Wildcards or Matching Symbols

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/moquette-io/moquette/security/…	x_refsource_CONFIRM
https://github.com/moquette-io/moquette/commit/b4…	x_refsource_MISC
https://github.com/moquette-io/moquette/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
moquette-io	moquette	Affected: < 0.18.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "moquette",
          "vendor": "moquette-io",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.18.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username values directly into rules containing %c or %u and then treats the result as an MQTT topic filter. A client that uses + or # in either identity can broaden the substituted filter and gain cross-tenant read and write access. A # identity can also produce an invalid filter that triggers a NullPointerException in Topic.match and disrupts session processing. This issue is fixed in version 0.18.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-155",
              "description": "CWE-155: Improper Neutralization of Wildcards or Matching Symbols",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T16:29:36.296Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq"
        },
        {
          "name": "https://github.com/moquette-io/moquette/commit/b4a98bb3f3425ece476ed073aa080c627c1239af",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/commit/b4a98bb3f3425ece476ed073aa080c627c1239af"
        },
        {
          "name": "https://github.com/moquette-io/moquette/releases/tag/v0.18.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/releases/tag/v0.18.1"
        }
      ],
      "source": {
        "advisory": "GHSA-5f42-97gr-vfhq",
        "discovery": "UNKNOWN"
      },
      "title": "Moquette pattern ACL wildcard injection allows cross-tenant authorization bypass"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-85724",
    "datePublished": "2026-09-23T16:29:36.296Z",
    "dateReserved": "2026-09-04T14:45:10.648Z",
    "dateUpdated": "2026-09-23T16:29:36.296Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-85058 (GCVE-0-2026-85058)

Vulnerability from nvd – Published: 2026-09-18 17:40 – Updated: 2026-09-22 15:14

Title

Moquette: Missing Authorization in io.moquette:moquette-broker

Summary

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client-controlled Last Will message through publish2Subscribers without invoking the authorizator.canWrite check used by normal PUBLISH paths. When anonymous access is enabled and topic ACLs restrict writes, a remote client can set an ACL-protected topic as the Last Will Topic during CONNECT and perform an abnormal client disconnect, causing the broker to inject attacker-controlled messages into a topic for which the client lacks write permission. This issue is fixed in version 0.18.1.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-22 15:13 UTC

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/moquette-io/moquette/security/…	x_refsource_CONFIRM
https://github.com/moquette-io/moquette/commit/e2…	x_refsource_MISC
https://github.com/moquette-io/moquette/commit/f5…	x_refsource_MISC
https://github.com/moquette-io/moquette/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
moquette-io	moquette	Affected: < 0.18.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-85058",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T15:13:17.846630Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T15:14:00.736Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/moquette-io/moquette/security/advisories/GHSA-9jjc-fw8x-fmwx"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "moquette",
          "vendor": "moquette-io",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.18.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client-controlled Last Will message through publish2Subscribers without invoking the authorizator.canWrite check used by normal PUBLISH paths. When anonymous access is enabled and topic ACLs restrict writes, a remote client can set an ACL-protected topic as the Last Will Topic during CONNECT and perform an abnormal client disconnect, causing the broker to inject attacker-controlled messages into a topic for which the client lacks write permission. This issue is fixed in version 0.18.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:40:39.113Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/moquette-io/moquette/security/advisories/GHSA-9jjc-fw8x-fmwx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/moquette-io/moquette/security/advisories/GHSA-9jjc-fw8x-fmwx"
        },
        {
          "name": "https://github.com/moquette-io/moquette/commit/e23df019f6a11e22c7d2047d4f86d07095466c97",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/commit/e23df019f6a11e22c7d2047d4f86d07095466c97"
        },
        {
          "name": "https://github.com/moquette-io/moquette/commit/f5a323fe782d1505c0097498cb22eb6ec6c96973",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/commit/f5a323fe782d1505c0097498cb22eb6ec6c96973"
        },
        {
          "name": "https://github.com/moquette-io/moquette/releases/tag/v0.18.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/releases/tag/v0.18.1"
        }
      ],
      "source": {
        "advisory": "GHSA-9jjc-fw8x-fmwx",
        "discovery": "UNKNOWN"
      },
      "title": "Moquette: Missing Authorization in io.moquette:moquette-broker"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-85058",
    "datePublished": "2026-09-18T17:40:39.113Z",
    "dateReserved": "2026-09-02T21:21:01.774Z",
    "dateUpdated": "2026-09-22T15:14:00.736Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-95848 (GCVE-0-2026-95848)

Vulnerability from cvelistv5 – Published: 2026-09-23 16:29 – Updated: 2026-09-23 17:58

Title

Moquette fails open when configured authentication or authorization classes cannot load

Summary

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured authenticator or authorizator class cannot be loaded, Server.initializeAuthenticator and Server.initializeAuthorizatorPolicy treat the failure as though no custom class was configured and fall back to AcceptAllAuthenticator or PermitAllAuthorizatorPolicy. A misspelled class name, missing dependency, constructor failure, or classpath problem can therefore start the broker with authentication or authorization disabled even though the operator configured those controls. This issue is fixed in version 0.18.1.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-23 17:58 UTC

CWE

CWE-636 - Not Failing Securely ('Failing Open')

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/moquette-io/moquette/security/…	x_refsource_CONFIRM
https://github.com/moquette-io/moquette/pull/967	x_refsource_MISC
https://github.com/moquette-io/moquette/commit/14…	x_refsource_MISC
https://github.com/moquette-io/moquette/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
moquette-io	moquette	Affected: < 0.18.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-95848",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T17:58:35.511233Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T17:58:59.375Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "moquette",
          "vendor": "moquette-io",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.18.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured authenticator or authorizator class cannot be loaded, Server.initializeAuthenticator and Server.initializeAuthorizatorPolicy treat the failure as though no custom class was configured and fall back to AcceptAllAuthenticator or PermitAllAuthorizatorPolicy. A misspelled class name, missing dependency, constructor failure, or classpath problem can therefore start the broker with authentication or authorization disabled even though the operator configured those controls. This issue is fixed in version 0.18.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-636",
              "description": "CWE-636: Not Failing Securely (\u0027Failing Open\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T16:29:58.300Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq"
        },
        {
          "name": "https://github.com/moquette-io/moquette/pull/967",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/pull/967"
        },
        {
          "name": "https://github.com/moquette-io/moquette/commit/14a2f4fd280c8f6a791600c306cbccecb7c67007",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/commit/14a2f4fd280c8f6a791600c306cbccecb7c67007"
        },
        {
          "name": "https://github.com/moquette-io/moquette/releases/tag/v0.18.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/releases/tag/v0.18.1"
        }
      ],
      "source": {
        "advisory": "GHSA-h285-r7h3-gfjg",
        "discovery": "UNKNOWN"
      },
      "title": "Moquette fails open when configured authentication or authorization classes cannot load"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-95848",
    "datePublished": "2026-09-23T16:29:58.300Z",
    "dateReserved": "2026-09-22T16:39:45.794Z",
    "dateUpdated": "2026-09-23T17:58:59.375Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-95847 (GCVE-0-2026-95847)

Vulnerability from cvelistv5 – Published: 2026-09-23 16:29 – Updated: 2026-09-23 16:50

Title

Moquette client IDs can cause cross-session H2 durable-queue corruption

Summary

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, H2PersistentQueue derives a session's message-map name as queue_ plus the client ID and its metadata-map name as queue_ plus the client ID plus _meta. A durable session whose client ID ends in _meta can therefore make its message map collide with another client's metadata map. The colliding sessions read and write the same H2 MVStore map with incompatible value types, which can corrupt queue head and tail data and cause message loss, misdelivery, failed queue reloads, or exposure of queued content across sessions. This issue is fixed in version 0.18.1.

Severity

8.8 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-23 16:50 UTC

CWE

CWE-99 - Improper Control of Resource Identifiers ('Resource Injection')

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/moquette-io/moquette/security/…	x_refsource_CONFIRM
https://github.com/moquette-io/moquette/pull/964	x_refsource_MISC
https://github.com/moquette-io/moquette/commit/72…	x_refsource_MISC
https://github.com/moquette-io/moquette/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
moquette-io	moquette	Affected: < 0.18.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-95847",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T16:50:06.329970Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T16:50:25.152Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "moquette",
          "vendor": "moquette-io",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.18.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, H2PersistentQueue derives a session\u0027s message-map name as queue_ plus the client ID and its metadata-map name as queue_ plus the client ID plus _meta. A durable session whose client ID ends in _meta can therefore make its message map collide with another client\u0027s metadata map. The colliding sessions read and write the same H2 MVStore map with incompatible value types, which can corrupt queue head and tail data and cause message loss, misdelivery, failed queue reloads, or exposure of queued content across sessions. This issue is fixed in version 0.18.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-99",
              "description": "CWE-99: Improper Control of Resource Identifiers (\u0027Resource Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T16:29:56.125Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq"
        },
        {
          "name": "https://github.com/moquette-io/moquette/pull/964",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/pull/964"
        },
        {
          "name": "https://github.com/moquette-io/moquette/commit/72d6c8257191d2e4b2e3aa11ab25fd09f88c6cb7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/commit/72d6c8257191d2e4b2e3aa11ab25fd09f88c6cb7"
        },
        {
          "name": "https://github.com/moquette-io/moquette/releases/tag/v0.18.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/releases/tag/v0.18.1"
        }
      ],
      "source": {
        "advisory": "GHSA-xx3c-pm46-jg78",
        "discovery": "UNKNOWN"
      },
      "title": "Moquette client IDs can cause cross-session H2 durable-queue corruption"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-95847",
    "datePublished": "2026-09-23T16:29:56.125Z",
    "dateReserved": "2026-09-22T16:39:45.794Z",
    "dateUpdated": "2026-09-23T16:50:25.152Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-95846 (GCVE-0-2026-95846)

Vulnerability from cvelistv5 – Published: 2026-09-23 16:29 – Updated: 2026-09-23 16:29

Title

Moquette publishes Last-Will messages without enforcing write authorization

Summary

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will message without applying the canWrite authorization and reserved-topic checks used for a normal PUBLISH. A client can configure a Will for a topic that the client is not permitted to write and cause the broker to publish the unauthorized message when the client disconnects unexpectedly. This issue allows unauthorized message injection into restricted topics. This issue is fixed in version 0.18.1.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/moquette-io/moquette/security/…	x_refsource_CONFIRM
https://github.com/moquette-io/moquette/commit/f5…	x_refsource_MISC
https://github.com/moquette-io/moquette/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
moquette-io	moquette	Affected: < 0.18.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "moquette",
          "vendor": "moquette-io",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.18.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client\u0027s Last-Will message without applying the canWrite authorization and reserved-topic checks used for a normal PUBLISH. A client can configure a Will for a topic that the client is not permitted to write and cause the broker to publish the unauthorized message when the client disconnects unexpectedly. This issue allows unauthorized message injection into restricted topics. This issue is fixed in version 0.18.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T16:29:54.130Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq"
        },
        {
          "name": "https://github.com/moquette-io/moquette/commit/f5a323fe782d1505c0097498cb22eb6ec6c96973",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/commit/f5a323fe782d1505c0097498cb22eb6ec6c96973"
        },
        {
          "name": "https://github.com/moquette-io/moquette/releases/tag/v0.18.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/releases/tag/v0.18.1"
        }
      ],
      "source": {
        "advisory": "GHSA-3rhq-5crp-9w5f",
        "discovery": "UNKNOWN"
      },
      "title": "Moquette publishes Last-Will messages without enforcing write authorization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-95846",
    "datePublished": "2026-09-23T16:29:54.130Z",
    "dateReserved": "2026-09-22T16:39:45.793Z",
    "dateUpdated": "2026-09-23T16:29:54.130Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-95845 (GCVE-0-2026-95845)

Vulnerability from cvelistv5 – Published: 2026-09-23 16:29 – Updated: 2026-09-23 19:44

Title

Moquette unbounded per-session message queues allow memory exhaustion

Summary

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, the broker does not enforce a maximum length for pending per-session message queues. When a fast publisher sends messages to a slow subscriber whose in-flight window is full, queued messages can accumulate without bound in memory or persistent storage. Remote clients can use this condition to exhaust broker resources and cause a denial of service. This issue is fixed in version 0.18.1.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-23 18:06 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/moquette-io/moquette/security/…	x_refsource_CONFIRM
https://github.com/moquette-io/moquette/commit/24…	x_refsource_MISC
https://github.com/moquette-io/moquette/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
moquette-io	moquette	Affected: < 0.18.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-95845",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T18:06:26.358093Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T19:44:31.486Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "moquette",
          "vendor": "moquette-io",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.18.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, the broker does not enforce a maximum length for pending per-session message queues. When a fast publisher sends messages to a slow subscriber whose in-flight window is full, queued messages can accumulate without bound in memory or persistent storage. Remote clients can use this condition to exhaust broker resources and cause a denial of service. This issue is fixed in version 0.18.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T16:29:51.402Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq"
        },
        {
          "name": "https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba"
        },
        {
          "name": "https://github.com/moquette-io/moquette/releases/tag/v0.18.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/releases/tag/v0.18.1"
        }
      ],
      "source": {
        "advisory": "GHSA-f9rr-rg42-xc8x",
        "discovery": "UNKNOWN"
      },
      "title": "Moquette unbounded per-session message queues allow memory exhaustion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-95845",
    "datePublished": "2026-09-23T16:29:51.402Z",
    "dateReserved": "2026-09-22T16:39:45.793Z",
    "dateUpdated": "2026-09-23T19:44:31.486Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-95844 (GCVE-0-2026-95844)

Vulnerability from cvelistv5 – Published: 2026-09-23 16:29 – Updated: 2026-09-23 16:29

Title

Moquette deeply nested MQTT topics can cause stack exhaustion

Summary

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, Moquette does not limit the depth of topic names and topic filters before processing them through recursive CTrie insertion and matching operations. A remote client can publish or subscribe with a deeply nested topic, causing a StackOverflowError that disrupts session processing and can deny service to broker clients. This issue is fixed in version 0.18.1.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CWE

CWE-674 - Uncontrolled Recursion

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/moquette-io/moquette/security/…	x_refsource_CONFIRM
https://github.com/moquette-io/moquette/commit/ca…	x_refsource_MISC
https://github.com/moquette-io/moquette/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
moquette-io	moquette	Affected: < 0.18.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "moquette",
          "vendor": "moquette-io",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.18.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, Moquette does not limit the depth of topic names and topic filters before processing them through recursive CTrie insertion and matching operations. A remote client can publish or subscribe with a deeply nested topic, causing a StackOverflowError that disrupts session processing and can deny service to broker clients. This issue is fixed in version 0.18.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T16:29:49.416Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq"
        },
        {
          "name": "https://github.com/moquette-io/moquette/commit/ca17e0be19e86d5e291f4532dfdc94616c8e0049",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/commit/ca17e0be19e86d5e291f4532dfdc94616c8e0049"
        },
        {
          "name": "https://github.com/moquette-io/moquette/releases/tag/v0.18.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/releases/tag/v0.18.1"
        }
      ],
      "source": {
        "advisory": "GHSA-446h-6w49-5x92",
        "discovery": "UNKNOWN"
      },
      "title": "Moquette deeply nested MQTT topics can cause stack exhaustion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-95844",
    "datePublished": "2026-09-23T16:29:49.416Z",
    "dateReserved": "2026-09-22T16:39:45.793Z",
    "dateUpdated": "2026-09-23T16:29:49.416Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-95843 (GCVE-0-2026-95843)

Vulnerability from cvelistv5 – Published: 2026-09-23 16:29 – Updated: 2026-09-23 17:58

Title

Moquette malformed shared subscriptions can crash command processing

Summary

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.subscribe parses a shared-subscription filter through SharedSubscriptionUtils.extractShareName before validating the complete $share/{shareName}/{topicFilter} structure. A remote client can send a filter such as $share/grp without a topic-filter portion, causing a StringIndexOutOfBoundsException while calculating the share name. The exception terminates command handling on the shared session event loop and can deny service to other client sessions assigned to that loop. This issue is fixed in version 0.18.1.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-23 17:57 UTC

CWE

CWE-20 - Improper Input Validation

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/moquette-io/moquette/security/…	x_refsource_CONFIRM
https://github.com/moquette-io/moquette/pull/962	x_refsource_MISC
https://github.com/moquette-io/moquette/commit/af…	x_refsource_MISC
https://github.com/moquette-io/moquette/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
moquette-io	moquette	Affected: < 0.18.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-95843",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T17:57:47.160479Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T17:58:06.940Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "moquette",
          "vendor": "moquette-io",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.18.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.subscribe parses a shared-subscription filter through SharedSubscriptionUtils.extractShareName before validating the complete $share/{shareName}/{topicFilter} structure. A remote client can send a filter such as $share/grp without a topic-filter portion, causing a StringIndexOutOfBoundsException while calculating the share name. The exception terminates command handling on the shared session event loop and can deny service to other client sessions assigned to that loop. This issue is fixed in version 0.18.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T16:29:44.588Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq"
        },
        {
          "name": "https://github.com/moquette-io/moquette/pull/962",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/pull/962"
        },
        {
          "name": "https://github.com/moquette-io/moquette/commit/affdc71fdba92dc020421678970ae70518fb6da2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/commit/affdc71fdba92dc020421678970ae70518fb6da2"
        },
        {
          "name": "https://github.com/moquette-io/moquette/releases/tag/v0.18.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/releases/tag/v0.18.1"
        }
      ],
      "source": {
        "advisory": "GHSA-56p9-97wj-c789",
        "discovery": "UNKNOWN"
      },
      "title": "Moquette malformed shared subscriptions can crash command processing"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-95843",
    "datePublished": "2026-09-23T16:29:44.588Z",
    "dateReserved": "2026-09-22T16:39:45.793Z",
    "dateUpdated": "2026-09-23T17:58:06.940Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-95842 (GCVE-0-2026-95842)

Vulnerability from cvelistv5 – Published: 2026-09-23 16:29 – Updated: 2026-09-23 16:49

Title

Moquette uncaught MQTT command exceptions can terminate shared session event loops

Summary

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, SessionEventLoop.run catches only InterruptedException, and SessionEventLoopGroup does not restart a terminated loop. An MQTT command that raises an uncaught exception can terminate an event loop shared by multiple client sessions, preventing every co-located client from processing PUBLISH, SUBSCRIBE, PUBACK, and other commands. An attacker can select client IDs that map across the available loops to disrupt session processing for the entire broker. This issue is fixed in version 0.18.1.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-23 16:48 UTC

CWE

CWE-248 - Uncaught Exception

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/moquette-io/moquette/security/…	x_refsource_CONFIRM
https://github.com/moquette-io/moquette/pull/957	x_refsource_MISC
https://github.com/moquette-io/moquette/commit/86…	x_refsource_MISC
https://github.com/moquette-io/moquette/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
moquette-io	moquette	Affected: < 0.18.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-95842",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T16:48:36.420367Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T16:49:25.405Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "moquette",
          "vendor": "moquette-io",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.18.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, SessionEventLoop.run catches only InterruptedException, and SessionEventLoopGroup does not restart a terminated loop. An MQTT command that raises an uncaught exception can terminate an event loop shared by multiple client sessions, preventing every co-located client from processing PUBLISH, SUBSCRIBE, PUBACK, and other commands. An attacker can select client IDs that map across the available loops to disrupt session processing for the entire broker. This issue is fixed in version 0.18.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "CWE-248: Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T16:29:41.744Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq"
        },
        {
          "name": "https://github.com/moquette-io/moquette/pull/957",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/pull/957"
        },
        {
          "name": "https://github.com/moquette-io/moquette/commit/86feb7c31e6fac849c465d8079d08c0e7ef01cdf",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/commit/86feb7c31e6fac849c465d8079d08c0e7ef01cdf"
        },
        {
          "name": "https://github.com/moquette-io/moquette/releases/tag/v0.18.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/releases/tag/v0.18.1"
        }
      ],
      "source": {
        "advisory": "GHSA-pqwr-fmcp-mjq7",
        "discovery": "UNKNOWN"
      },
      "title": "Moquette uncaught MQTT command exceptions can terminate shared session event loops"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-95842",
    "datePublished": "2026-09-23T16:29:41.744Z",
    "dateReserved": "2026-09-22T16:39:45.793Z",
    "dateUpdated": "2026-09-23T16:49:25.405Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-85724 (GCVE-0-2026-85724)

Vulnerability from cvelistv5 – Published: 2026-09-23 16:29 – Updated: 2026-09-23 16:29

Title

Moquette pattern ACL wildcard injection allows cross-tenant authorization bypass

Summary

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username values directly into rules containing %c or %u and then treats the result as an MQTT topic filter. A client that uses + or # in either identity can broaden the substituted filter and gain cross-tenant read and write access. A # identity can also produce an invalid filter that triggers a NullPointerException in Topic.match and disrupts session processing. This issue is fixed in version 0.18.1.

Severity

9.6 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

CWE

CWE-863 - Incorrect Authorization
CWE-155 - Improper Neutralization of Wildcards or Matching Symbols

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/moquette-io/moquette/security/…	x_refsource_CONFIRM
https://github.com/moquette-io/moquette/commit/b4…	x_refsource_MISC
https://github.com/moquette-io/moquette/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
moquette-io	moquette	Affected: < 0.18.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "moquette",
          "vendor": "moquette-io",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.18.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username values directly into rules containing %c or %u and then treats the result as an MQTT topic filter. A client that uses + or # in either identity can broaden the substituted filter and gain cross-tenant read and write access. A # identity can also produce an invalid filter that triggers a NullPointerException in Topic.match and disrupts session processing. This issue is fixed in version 0.18.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-155",
              "description": "CWE-155: Improper Neutralization of Wildcards or Matching Symbols",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T16:29:36.296Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq"
        },
        {
          "name": "https://github.com/moquette-io/moquette/commit/b4a98bb3f3425ece476ed073aa080c627c1239af",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/commit/b4a98bb3f3425ece476ed073aa080c627c1239af"
        },
        {
          "name": "https://github.com/moquette-io/moquette/releases/tag/v0.18.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/releases/tag/v0.18.1"
        }
      ],
      "source": {
        "advisory": "GHSA-5f42-97gr-vfhq",
        "discovery": "UNKNOWN"
      },
      "title": "Moquette pattern ACL wildcard injection allows cross-tenant authorization bypass"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-85724",
    "datePublished": "2026-09-23T16:29:36.296Z",
    "dateReserved": "2026-09-04T14:45:10.648Z",
    "dateUpdated": "2026-09-23T16:29:36.296Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-85058 (GCVE-0-2026-85058)

Vulnerability from cvelistv5 – Published: 2026-09-18 17:40 – Updated: 2026-09-22 15:14

Title

Moquette: Missing Authorization in io.moquette:moquette-broker

Summary

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client-controlled Last Will message through publish2Subscribers without invoking the authorizator.canWrite check used by normal PUBLISH paths. When anonymous access is enabled and topic ACLs restrict writes, a remote client can set an ACL-protected topic as the Last Will Topic during CONNECT and perform an abnormal client disconnect, causing the broker to inject attacker-controlled messages into a topic for which the client lacks write permission. This issue is fixed in version 0.18.1.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-22 15:13 UTC

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/moquette-io/moquette/security/…	x_refsource_CONFIRM
https://github.com/moquette-io/moquette/commit/e2…	x_refsource_MISC
https://github.com/moquette-io/moquette/commit/f5…	x_refsource_MISC
https://github.com/moquette-io/moquette/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
moquette-io	moquette	Affected: < 0.18.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-85058",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T15:13:17.846630Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T15:14:00.736Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/moquette-io/moquette/security/advisories/GHSA-9jjc-fw8x-fmwx"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "moquette",
          "vendor": "moquette-io",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.18.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client-controlled Last Will message through publish2Subscribers without invoking the authorizator.canWrite check used by normal PUBLISH paths. When anonymous access is enabled and topic ACLs restrict writes, a remote client can set an ACL-protected topic as the Last Will Topic during CONNECT and perform an abnormal client disconnect, causing the broker to inject attacker-controlled messages into a topic for which the client lacks write permission. This issue is fixed in version 0.18.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:40:39.113Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/moquette-io/moquette/security/advisories/GHSA-9jjc-fw8x-fmwx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/moquette-io/moquette/security/advisories/GHSA-9jjc-fw8x-fmwx"
        },
        {
          "name": "https://github.com/moquette-io/moquette/commit/e23df019f6a11e22c7d2047d4f86d07095466c97",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/commit/e23df019f6a11e22c7d2047d4f86d07095466c97"
        },
        {
          "name": "https://github.com/moquette-io/moquette/commit/f5a323fe782d1505c0097498cb22eb6ec6c96973",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/commit/f5a323fe782d1505c0097498cb22eb6ec6c96973"
        },
        {
          "name": "https://github.com/moquette-io/moquette/releases/tag/v0.18.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moquette-io/moquette/releases/tag/v0.18.1"
        }
      ],
      "source": {
        "advisory": "GHSA-9jjc-fw8x-fmwx",
        "discovery": "UNKNOWN"
      },
      "title": "Moquette: Missing Authorization in io.moquette:moquette-broker"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-85058",
    "datePublished": "2026-09-18T17:40:39.113Z",
    "dateReserved": "2026-09-02T21:21:01.774Z",
    "dateUpdated": "2026-09-22T15:14:00.736Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

18 vulnerabilities by moquette-io

CVE-2026-95848 (GCVE-0-2026-95848)

CVE-2026-95847 (GCVE-0-2026-95847)

CVE-2026-95846 (GCVE-0-2026-95846)

CVE-2026-95845 (GCVE-0-2026-95845)

CVE-2026-95844 (GCVE-0-2026-95844)

CVE-2026-95843 (GCVE-0-2026-95843)

CVE-2026-95842 (GCVE-0-2026-95842)

CVE-2026-85724 (GCVE-0-2026-85724)

CVE-2026-85058 (GCVE-0-2026-85058)

CVE-2026-95848 (GCVE-0-2026-95848)

CVE-2026-95847 (GCVE-0-2026-95847)

CVE-2026-95846 (GCVE-0-2026-95846)

CVE-2026-95845 (GCVE-0-2026-95845)

CVE-2026-95844 (GCVE-0-2026-95844)

CVE-2026-95843 (GCVE-0-2026-95843)

CVE-2026-95842 (GCVE-0-2026-95842)

CVE-2026-85724 (GCVE-0-2026-85724)

CVE-2026-85058 (GCVE-0-2026-85058)