CVE-2026-95844 is a high severity (CVSS 7.5) denial of service in the Moquette Java MQTT broker before 0.18.1. The broker does not limit topic depth before recursive processing, so a deeply nested topic causes a StackOverflowError. The fixed versions are 0.18.1 and 0.19.0.
What's affected
The record says Moquette before 0.18.1 is affected. The advisory lists up to 0.18.0 and names 0.18.1 and 0.19.0 as patched. The weakness is CWE-674, uncontrolled recursion.
Per the record, topic names and topic filters are not capped in depth before the broker processes them in recursive insertion and matching operations on its topic tree. A remote client can publish or subscribe with a deeply nested topic, and the resulting stack overflow disrupts session processing and can deny service to broker clients.
The vector is network, low complexity, no privileges, high availability impact. The broker accepts anonymous clients by default, per the advisory, so the barrier to trying it is low.
How to check if you're exposed
Moquette is an embedded Java MQTT broker, so it often hides inside an application rather than running as its own service. Search your build for it.
mvn dependency:tree | grep -i moquette
gradle dependencies | grep -i moquette
Look for the moquette-broker artifact and its version. Anything at or below 0.18.0 is in scope per the advisory. Also check container images and fat jars, where the library is bundled inside another file.
Then ask who can connect. The advisory notes that the broker is reachable by untrusted MQTT clients and, by default, accepts anonymous ones.
What to do now
- Upgrade Moquette to 0.18.1 or later. The advisory lists 0.18.1 and 0.19.0 as patched.
- Rebuild and redeploy every application that embeds the broker, since a library update does nothing until the application is rebuilt.
- Turn off anonymous access if you do not need it and require authentication for clients.
- Put the broker port behind a firewall or private network where clients are known.
- Where you can, set limits on topic length and depth at a gateway or in your client libraries as an extra layer.
- Watch broker logs for StackOverflowError and for sessions that stop responding.
- Paste your lockfile or manifest into the free in-browser dependency scan to see whether the affected package is in your tree, then use reachability analysis to separate code paths you call from ones you never touch.
Why it matters
Recursive code is tidy until the depth is chosen by someone else. Each level of a topic adds a frame to the stack, and a long enough topic uses it all. CWE-674 is the weakness of recursion with no bound. The fix is a limit on depth, applied before the recursion starts.
Because one failing thread can serve many sessions in this broker, the damage is not confined to the sender's own connection. The advisory that covers these fixes also describes other problems in the broker, including a pattern based authorization bypass, so upgrading is the safe course rather than picking individual fixes. The record does not mark exploitation, and the CVE is not in CISA's catalog.
Quick check
What limits did Moquette lack?
A maximum depth for topic names and topic filters, according to the record.
Is an authenticated client required?
The record lists no privileges required.
Sources
Last reviewed: 18 October 2026.
