# io.moquette:moquette-broker (Maven) vulnerabilities 9 known vulnerabilities (2 critical, 7 high), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 0.17 (Aug 2, 2023): affected by 9 advisories - Newest unaffected release: Every release is affected by at least one advisory - Dependents: 41 - Releases: 3 since 0.15 (Jul 23, 2021) - Registry: https://central.sonatype.com/artifact/io.moquette/moquette-broker - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-95848: 0.15 to 0.17 (through the newest release) - CVE-2026-95847: 0.15 to 0.17 (through the newest release) - CVE-2026-95846: 0.15 to 0.17 (through the newest release) - CVE-2026-95845: 0.15 to 0.17 (through the newest release) - CVE-2026-95844: 0.15 to 0.17 (through the newest release) - CVE-2026-95843: 0.15 to 0.17 (through the newest release) - CVE-2026-95842: 0.15 to 0.17 (through the newest release) - CVE-2026-85724: 0.15 to 0.17 (through the newest release) - CVE-2026-85058: 0.15 to 0.17 (through the newest release) ## Advisories (9) ### [CVE-2026-95848](https://cve.now/CVE-2026-95848): Moquette fails open when configured authentication or authorization classes cannot load - Severity: Critical 9.3 - Published: Sep 23, 2026 - Affected: fixed in 0.18.1. - No fix released. The advisory names 0.18.1 as the fix, which the registry doesn't have yet. The latest release, 0.17, is still affected. ### [CVE-2026-95847](https://cve.now/CVE-2026-95847): Moquette client IDs can cause cross-session H2 durable-queue corruption - Severity: High 8.8 - Published: Sep 23, 2026 - Affected: fixed in 0.18.1. - No fix released. The advisory names 0.18.1 as the fix, which the registry doesn't have yet. The latest release, 0.17, is still affected. ### [CVE-2026-95846](https://cve.now/CVE-2026-95846): Moquette publishes Last-Will messages without enforcing write authorization - Severity: High 8.7 - Published: Sep 23, 2026 - Affected: fixed in 0.18.1. - No fix released. The advisory names 0.18.1 as the fix, which the registry doesn't have yet. The latest release, 0.17, is still affected. ### [CVE-2026-95845](https://cve.now/CVE-2026-95845): Moquette unbounded per-session message queues allow memory exhaustion - Severity: High 8.7 - Published: Sep 23, 2026 - Affected: fixed in 0.18.1. - No fix released. The advisory names 0.18.1 as the fix, which the registry doesn't have yet. The latest release, 0.17, is still affected. ### [CVE-2026-95844](https://cve.now/CVE-2026-95844): Moquette deeply nested MQTT topics can cause stack exhaustion - Severity: High 8.7 - Published: Sep 23, 2026 - Affected: fixed in 0.18.1. - No fix released. The advisory names 0.18.1 as the fix, which the registry doesn't have yet. The latest release, 0.17, is still affected. ### [CVE-2026-95843](https://cve.now/CVE-2026-95843): Moquette malformed shared subscriptions can crash command processing - Severity: High 8.7 - Published: Sep 23, 2026 - Affected: fixed in 0.18.1. - No fix released. The advisory names 0.18.1 as the fix, which the registry doesn't have yet. The latest release, 0.17, is still affected. ### [CVE-2026-95842](https://cve.now/CVE-2026-95842): Moquette uncaught MQTT command exceptions can terminate shared session event loops - Severity: High 8.7 - Published: Sep 23, 2026 - Affected: fixed in 0.18.1. - No fix released. The advisory names 0.18.1 as the fix, which the registry doesn't have yet. The latest release, 0.17, is still affected. ### [CVE-2026-85724](https://cve.now/CVE-2026-85724): Moquette pattern ACL wildcard injection allows cross-tenant authorization bypass - Severity: Critical 9.6 - Published: Sep 23, 2026 - Affected: fixed in 0.18.1. - No fix released. The advisory names 0.18.1 as the fix, which the registry doesn't have yet. The latest release, 0.17, is still affected. ### [CVE-2026-85058](https://cve.now/CVE-2026-85058): Moquette: Missing Authorization in io.moquette:moquette-broker - Severity: High 7.5 - Published: Sep 18, 2026 - Affected: fixed in 0.18.1. - No fix released. The advisory names 0.18.1 as the fix, which the registry doesn't have yet. The latest release, 0.17, is still affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/io.moquette:moquette-broker Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.