CVE-2026-95844 Moquette deeply nested MQTT topics can cause stack exhaustion

What is CVE-2026-95844?

CVE-2026-95844 is a high-severity denial of service vulnerability in moquette-io moquette, published on 23 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, Moquette does not limit the depth of topic names and topic filters before processing them through recursive CTrie insertion and matching operations. A remote client can publish or subscribe with a deeply nested topic, causing a StackOverflowError that disrupts session processing and can deny service to broker clients. This issue is fixed in version 0.18.1.

Weakness: CWE-674

Which versions are affected by CVE-2026-95844?

It affects 1 product.

Products include Moquette Moquette.

How do I fix CVE-2026-95844?

No fix has been published for CVE-2026-95844 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-95844 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-95844 exists.

Other vulnerabilities in moquette-io moquette

• CVE-2026-85724 Moquette pattern ACL wildcard injection allows cross-tenant authorization bypass Critical 9.6
• CVE-2026-95848 Moquette fails open when configured authentication or authorization classes cannot load Critical 9.3
• CVE-2026-95847 Moquette client IDs can cause cross-session H2 durable-queue corruption High 8.8
• CVE-2026-95842 Moquette uncaught MQTT command exceptions can terminate shared session event loops High 8.7
• CVE-2026-95843 Moquette malformed shared subscriptions can crash command processing High 8.7

Sources

• CVE record
• NVD
• OSV
• How this page is made