[ Vendor · 8 CVEs ]
moquette-io
CVEs affecting moquette-io published in the last 30 days, plus any moquette-io CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-95843 | 23 Sep 2026 | CVSS 7.5 | moquette-io moquetteMoquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.subscribe parses a shared-subscription filter through… | Fix |
| CVE-2026-95844 | 23 Sep 2026 | CVSS 7.5 | moquette-io moquetteMoquette is a lightweight Java MQTT broker. Prior to 0.18.1, Moquette does not limit the depth of topic names and topic filters before processing… | Fix |
| CVE-2026-95845 | 23 Sep 2026 | CVSS 7.5 | moquette-io moquetteMoquette is a lightweight Java MQTT broker. Prior to 0.18.1, the broker does not enforce a maximum length for pending per-session message queues… | Fix |
| CVE-2026-95846 | 23 Sep 2026 | CVSS 7.5 | moquette-io moquetteMoquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will message without applying the… | Fix |
| CVE-2026-95847 | 23 Sep 2026 | CVSS 7.5 | moquette-io moquetteMoquette is a lightweight Java MQTT broker. Prior to 0.18.1, H2PersistentQueue derives a session's message-map name as queue_ plus the client ID and… | Fix |
| CVE-2026-95848 | 23 Sep 2026 | CVSS 9.1 | moquette-io moquetteMoquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured authenticator or authorizator class cannot be loaded… | Fix |
| CVE-2026-95842 | 23 Sep 2026 | CVSS 7.5 | moquette-io moquetteMoquette is a lightweight Java MQTT broker. Prior to 0.18.1, SessionEventLoop.run catches only InterruptedException, and SessionEventLoopGroup does… | Fix |
| CVE-2026-85724 | 23 Sep 2026 | CVSS 9.6 | Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message authorization bypass, and a cross-session durable-corruption bugMoquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation… | Fix |