moquette-io

Records9All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high7CVSS 7.0–8.9

Exploited now

moquette-io records in CISA KEV

No moquette-io vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Moquette 8 records HIGH

Records

8 records in Moquette · all components

TI-2026-63713 CVE-2026-95848

Moquette fails open when configured authentication or authorization classes cannot load

HIGH 81

Moquette is a lightweight Java MQTT broker.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00424 Published 2026-09-23 Fixed in 0.18.1 CWE-636

TI-2026-63712 CVE-2026-95847

Moquette client IDs can cause cross-session H2 durable-queue corruption

HIGH 77

Moquette is a lightweight Java MQTT broker.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00341 Published 2026-09-23 Fixed in 0.18.1 CWE-99

TI-2026-63711 CVE-2026-95846

Moquette publishes Last-Will messages without enforcing write authorization

HIGH 77

Moquette is a lightweight Java MQTT broker.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00319 Published 2026-09-23 Fixed in 0.18.1 CWE-862

TI-2026-63709 CVE-2026-95844

Moquette deeply nested MQTT topics can cause stack exhaustion

HIGH 77

Moquette is a lightweight Java MQTT broker.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00423 Published 2026-09-23 Fixed in 0.18.1 CWE-674

TI-2026-63708 CVE-2026-95843

Moquette malformed shared subscriptions can crash command processing

HIGH 77

Moquette is a lightweight Java MQTT broker.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00429 Published 2026-09-23 Fixed in 0.18.1 CWE-20

TI-2026-63707 CVE-2026-95842

Moquette uncaught MQTT command exceptions can terminate shared session event loops

HIGH 77

Moquette is a lightweight Java MQTT broker.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00438 Published 2026-09-23 Fixed in 0.18.1 CWE-248

TI-2026-58826 CVE-2026-85724 · GHSA-5f42-97gr-vfhq

Moquette pattern ACL wildcard injection allows cross-tenant authorization bypass

HIGH 76

Moquette is a lightweight Java MQTT broker.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00316 Published 2026-09-23 Fixed in 0.18.1 CWE-155

TI-2026-63710 CVE-2026-95845

Moquette unbounded per-session message queues allow memory exhaustion

MEDIUM 44

Moquette is a lightweight Java MQTT broker.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00415 Published 2026-09-23 Fixed in 0.18.1 CWE-770

Open these records in search →