MavenPackage

io.moquette:moquette-broker

9 known vulnerabilities (2 critical, 7 high), with the versions each affects and the releases that fix them.

Latest release: 0.17 (Aug 2, 2023): affected by 9 advisories
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 9 · 2 critical, 7 high

Dependents: 41
Releases: 3 since 0.15 (Jul 23, 2021)
Registry: Maven Central
Releases read: Nov 8, 2026

Version timeline

CVE-2026-95848
Affects 0.15 to 0.17 (through the newest release)
CVE-2026-95847
Affects 0.15 to 0.17 (through the newest release)
CVE-2026-95846
Affects 0.15 to 0.17 (through the newest release)
CVE-2026-95845
Affects 0.15 to 0.17 (through the newest release)
CVE-2026-95844
Affects 0.15 to 0.17 (through the newest release)
CVE-2026-95843
Affects 0.15 to 0.17 (through the newest release)
CVE-2026-95842
Affects 0.15 to 0.17 (through the newest release)
CVE-2026-85724
Affects 0.15 to 0.17 (through the newest release)
CVE-2026-85058
Affects 0.15 to 0.17 (through the newest release)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 9

CVE-2026-95848Critical 9.3
Moquette fails open when configured authentication or authorization classes cannot load
Affected: fixed in 0.18.1.
No fix released. The advisory names 0.18.1 as the fix, which the registry doesn't have yet. The latest release, 0.17, is still affected.
CVE-2026-95847High 8.8
Moquette client IDs can cause cross-session H2 durable-queue corruption
Affected: fixed in 0.18.1.
No fix released. The advisory names 0.18.1 as the fix, which the registry doesn't have yet. The latest release, 0.17, is still affected.
CVE-2026-95846High 8.7
Moquette publishes Last-Will messages without enforcing write authorization
Affected: fixed in 0.18.1.
No fix released. The advisory names 0.18.1 as the fix, which the registry doesn't have yet. The latest release, 0.17, is still affected.
CVE-2026-95845High 8.7
Moquette unbounded per-session message queues allow memory exhaustion
Affected: fixed in 0.18.1.
No fix released. The advisory names 0.18.1 as the fix, which the registry doesn't have yet. The latest release, 0.17, is still affected.
CVE-2026-95844High 8.7
Moquette deeply nested MQTT topics can cause stack exhaustion
Affected: fixed in 0.18.1.
No fix released. The advisory names 0.18.1 as the fix, which the registry doesn't have yet. The latest release, 0.17, is still affected.
CVE-2026-95843High 8.7
Moquette malformed shared subscriptions can crash command processing
Affected: fixed in 0.18.1.
No fix released. The advisory names 0.18.1 as the fix, which the registry doesn't have yet. The latest release, 0.17, is still affected.
CVE-2026-95842High 8.7
Moquette uncaught MQTT command exceptions can terminate shared session event loops
Affected: fixed in 0.18.1.
No fix released. The advisory names 0.18.1 as the fix, which the registry doesn't have yet. The latest release, 0.17, is still affected.
CVE-2026-85724Critical 9.6
Moquette pattern ACL wildcard injection allows cross-tenant authorization bypass
Affected: fixed in 0.18.1.
No fix released. The advisory names 0.18.1 as the fix, which the registry doesn't have yet. The latest release, 0.17, is still affected.
CVE-2026-85058High 7.5
Moquette: Missing Authorization in io.moquette:moquette-broker
Affected: fixed in 0.18.1.
No fix released. The advisory names 0.18.1 as the fix, which the registry doesn't have yet. The latest release, 0.17, is still affected.