CVE-2026-95844

Katalog CVE

CVSS 7.5 · High EPSS 0,36%

Kerentanan Uncontrolled Recursion pada moquette. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, Moquette does not limit the depth of topic names and topic filters before processing them through recursive CTrie insertion and matching operations. A remote client can publish or subscribe with a deeply nested topic, causing a StackOverflowError that disrupts session processing and can deny service to broker clients. This issue is fixed in version 0.18.1.

Rincian

Terbit di NVD

23 September 2026

Terakhir diubah

29 September 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-674: Uncontrolled Recursion

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 27,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq exploit · mitigasi · advisory vendor
• https://github.com/moquette-io/moquette/commit/ca17e0be19e86d5e291f4532dfdc94616c8e0049 patch
• https://github.com/moquette-io/moquette/releases/tag/v0.18.1 release notes