Moquette-Io

9 CVEs across 1 Moquette-Io products. Browse Moquette-Io vulnerabilities, severities, and proof-of-concept exploits.

Moquette-Io products with known CVEs

ProductCVEs
Moquette9
Moquette-Io CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-958482026-09-23Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured authenticator or authorizator class cannot be loaded, Server.initializeAuthentic…
CVE-2026-958472026-09-23Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, H2PersistentQueue derives a session's message-map name as queue_ plus the client ID and its metada…
CVE-2026-958462026-09-23Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will message without applying the canWrite author…
CVE-2026-958452026-09-23Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, the broker does not enforce a maximum length for pending per-session message queues. When a fast p…
CVE-2026-958442026-09-23Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, Moquette does not limit the depth of topic names and topic filters before processing them through…
CVE-2026-958432026-09-23Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.subscribe parses a shared-subscription filter through SharedSubscriptionUtils.extractSh…
CVE-2026-958422026-09-23Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, SessionEventLoop.run catches only InterruptedException, and SessionEventLoopGroup does not restart…
CVE-2026-85724Critical9.62026-09-23Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes cl…
CVE-2026-85058High7.52026-09-18Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client-controlled Last Will message through publish2Subscribers…