CVE-2026-95844: Moquette deeply nested MQTT topics can cause stack exhaustion
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, Moquette does not limit the depth of topic names and topic filters before processing them through recursive CTrie insertion and matching operations. A remote client can publish or subscribe with a deeply nested topic, causing a StackOverflowError that disrupts session processing and can deny service to broker clients. This issue is fixed in version 0.18.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Moquetteto a version that resolves this vulnerability.Fixed in 0.18.1
Event History
Frequently Asked Questions
Who can trigger the denial of service?
A remote MQTT client that can connect to the broker can trigger the issue by publishing to or subscribing with a deeply nested topic or topic filter.
Which deployments are affected?
Moquette versions before 0.18.1 are affected. The issue is in topic-name and topic-filter processing, and the provided information does not identify any configuration prerequisite.
What happens when the issue is exploited?
Recursive CTrie insertion or matching can exhaust the Java stack and raise a StackOverflowError. This disrupts session processing and can deny service to broker clients.
What is the available remediation?
Upgrade Moquette to version 0.18.1, which fixes the issue.