Gigioneggiando

**Name of the Vulnerable Software and Affected Versions** Moquette versions prior to 0.18.1 **Description** Moquette does not limit the depth of topic names and topic filters before processing them through recursive CTrie insertion and matching operations. A remote client can publish or subscribe using a deeply nested topic, triggering a StackOverflowError—a runtime error that occurs when the application's call stack exceeds its allocated limit—which disrupts session processing and results in a denial of service for broker clients. **Recommendations** Update to version 0.18.1.

**Name of the Vulnerable Software and Affected Versions** Moquette versions prior to 0.18.1 **Description** In the `H2PersistentQueue` component, session message-map names are derived using the prefix `queue ` followed by the client ID, while metadata-map names use `queue `, the client ID, and the suffix ` meta`. If a durable session uses a client ID that ends with ` meta`, its message map can collide with the metadata map of another client. This collision causes sessions to read and write to the same H2 MVStore map using incompatible value types, potentially leading to corrupted queue head and tail data, message loss, misdelivery, failed queue reloads, or the exposure of queued content between sessions. **Recommendations** Update to version 0.18.1.

**Name of the Vulnerable Software and Affected Versions** Moquette versions prior to 0.18.1 **Description** When a configured authenticator or authorizator class cannot be loaded, the `Server.initializeAuthenticator()` and `Server.initializeAuthorizatorPolicy()` functions treat the failure as if no custom class was configured. This causes the system to fall back to `AcceptAllAuthenticator` or `PermitAllAuthorizatorPolicy`. Consequently, issues such as misspelled class names, missing dependencies, constructor failures, or classpath problems can result in the broker starting with authentication or authorization disabled, despite the operator's configuration. **Recommendations** Update to version 0.18.1.