CVE-2026-95844

Name of the Vulnerable Software and Affected Versions Moquette versions prior to 0.18.1

Description Moquette does not limit the depth of topic names and topic filters before processing them through recursive CTrie insertion and matching operations. A remote client can publish or subscribe using a deeply nested topic, triggering a StackOverflowError—a runtime error that occurs when the application's call stack exceeds its allocated limit—which disrupts session processing and results in a denial of service for broker clients.

Recommendations Update to version 0.18.1.