CVE-2026-95844: CWE-674: Uncontrolled Recursion in moquette-io moquette
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, Moquette does not limit the depth of topic names and topic filters before processing them through recursive CTrie insertion and matching operations. A remote client can publish or subscribe with a deeply nested topic, causing a StackOverflowError that disrupts session processing and can deny service to broker clients. This issue is fixed in version 0.18.1.
AI Analysis
Technical Summary
Moquette, a lightweight Java MQTT broker, does not limit the recursion depth when processing topic names and filters through recursive CTrie insertion and matching operations in versions before 0.18.1. A remote attacker can exploit this by sending deeply nested topic strings, triggering a StackOverflowError that disrupts the broker's session processing and causes denial of service. The vulnerability is identified as CWE-674 (Uncontrolled Recursion) and has a CVSS 4.0 score of 8.7, indicating high severity. The issue is fixed in Moquette version 0.18.1.
Potential Impact
Exploitation of this vulnerability results in a denial of service condition on the MQTT broker by causing a StackOverflowError during session processing. This disrupts service availability for broker clients but does not require authentication or user interaction. There are no known exploits in the wild at this time.
Mitigation Recommendations
Upgrade Moquette to version 0.18.1 or later, where this uncontrolled recursion issue has been fixed. No other mitigations are specified or required.
CVE-2026-95844: CWE-674: Uncontrolled Recursion in moquette-io moquette
Description
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, Moquette does not limit the depth of topic names and topic filters before processing them through recursive CTrie insertion and matching operations. A remote client can publish or subscribe with a deeply nested topic, causing a StackOverflowError that disrupts session processing and can deny service to broker clients. This issue is fixed in version 0.18.1.
CVSS v4.0
Score 8.7high
Affected software
moquette-io
moquette
pkg:github/moquette-io/moquetteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Moquette, a lightweight Java MQTT broker, does not limit the recursion depth when processing topic names and filters through recursive CTrie insertion and matching operations in versions before 0.18.1. A remote attacker can exploit this by sending deeply nested topic strings, triggering a StackOverflowError that disrupts the broker's session processing and causes denial of service. The vulnerability is identified as CWE-674 (Uncontrolled Recursion) and has a CVSS 4.0 score of 8.7, indicating high severity. The issue is fixed in Moquette version 0.18.1.
Potential Impact
Exploitation of this vulnerability results in a denial of service condition on the MQTT broker by causing a StackOverflowError during session processing. This disrupts service availability for broker clients but does not require authentication or user interaction. There are no known exploits in the wild at this time.
Mitigation Recommendations
Upgrade Moquette to version 0.18.1 or later, where this uncontrolled recursion issue has been fixed. No other mitigations are specified or required.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-09-22T16:39:45.793Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ab402daf7a7c541060ee0d2
Added to database: 09/23/2026, 16:48:26 UTC
Last enriched: 09/23/2026, 17:03:44 UTC
Last updated: 09/24/2026, 02:34:04 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.