CVE-2026-95844: Moquette MQTT Broker DOS Vulnerability

CVE-2026-95844 Overview

CVE-2026-95844 is a denial-of-service vulnerability in Moquette, a lightweight Java MQTT broker. Versions prior to 0.18.1 do not enforce a depth limit on topic names or topic filters before passing them into recursive CTrie insertion and matching operations. A remote client can PUBLISH or SUBSCRIBE with a deeply nested topic to trigger a StackOverflowError, disrupting session processing and denying service to broker clients. The issue is classified as CWE-674: Uncontrolled Recursion and is fixed in version 0.18.1.

Critical Impact
An unauthenticated remote client can crash broker session processing and deny service to all connected MQTT clients by publishing or subscribing to a deeply nested topic.

Affected Products

Moquette MQTT broker versions prior to 0.18.1
Java applications embedding the Moquette broker library
IoT and messaging deployments exposing the broker to untrusted clients

Discovery Timeline

2026-09-23 - CVE-2026-95844 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-95844

Vulnerability Analysis

Moquette organizes MQTT topics into a Concurrent Trie (CTrie) data structure. Insertion and matching operations traverse this trie recursively, with one stack frame per topic level separated by the / delimiter. Because the broker did not validate topic depth before dispatching messages into the trie, attacker-controlled input directly determined recursion depth.

A client that sends a SUBSCRIBE or PUBLISH packet containing a topic filter such as a/a/a/.../a with thousands of levels forces the JVM to exhaust its call stack. The resulting StackOverflowError terminates the processing thread and disrupts broker-wide session handling, preventing legitimate clients from publishing or receiving messages.

Root Cause

The root cause is missing input validation on topic depth prior to invoking recursive CTrie operations. MQTT permits topic filters composed of arbitrarily many level separators, and Moquette translated each level into a recursive call without bounding the traversal.

Attack Vector

Exploitation requires only network access to the broker's MQTT listener. No authentication or user interaction is needed when the broker accepts anonymous connections, and any authenticated client with SUBSCRIBE or PUBLISH rights can trigger the crash on hardened deployments. The attacker sends a single MQTT control packet containing a topic with recursion depth exceeding the JVM stack size.

java

// Patch: broker/src/main/java/io/moquette/BrokerConstants.java
     public static final int RECEIVE_MAXIMUM = 65 * 1024;
 
     public static final int DISABLED_TOPIC_ALIAS = 0;
+    
+    public static final int MAX_TOPIC_DEPTH = 1024;
 
     private BrokerConstants() {
     }

Source: Moquette commit ca17e0b

java

// Patch: broker/src/main/java/io/moquette/broker/MQTTConnection.java
             dropConnection();
             return PostOffice.RouteResult.success(clientID, CompletableFuture.completedFuture(null));
         }
+        
+        if (checkIfAnyFilterInSubscriptionIsOversized(msg)) {
+            LOG.warn("SUBSCRIBE received topic deeper than {}", BrokerConstants.MAX_TOPIC_DEPTH);
+            dropConnection();
+            return PostOffice.RouteResult.success(clientID, CompletableFuture.completedFuture(null));
+        }
+        
         final String username = NettyUtils.userName(channel);
         return postOffice.routeCommand(clientID, "SUB", () -> {
             checkMatchSessionLoop(clientID);

Source: Moquette commit ca17e0b. The fix introduces a MAX_TOPIC_DEPTH constant of 1024 and drops the client connection whenever a subscription filter exceeds this depth.

Detection Methods for CVE-2026-95844

Indicators of Compromise

Broker log entries containing java.lang.StackOverflowError originating from CTrie insertion or matching stack frames.
MQTT SUBSCRIBE or PUBLISH packets carrying topic strings with unusually high counts of the / separator.
Sudden broker thread termination, unexpected session drops, or restart loops correlated with a single client identifier.

Detection Strategies

Inspect MQTT traffic at the network or proxy layer and flag topic strings whose level count exceeds a reasonable operational baseline (for example, more than 32 levels).
Correlate broker JVM error logs with client source IP and MQTT client identifier to isolate abusive senders.
Monitor Moquette process health metrics for abrupt thread pool depletion or process restarts that follow inbound MQTT packets.

Monitoring Recommendations

Ship broker stdout, stderr, and JVM crash logs into a centralized log platform and alert on StackOverflowError occurrences.
Track connection churn per client identifier and per source IP to surface clients that trigger repeated broker faults.
Baseline normal MQTT topic depth in your environment and alert on statistical outliers.

How to Mitigate CVE-2026-95844

Immediate Actions Required

Upgrade Moquette to version 0.18.1 or later, which enforces the MAX_TOPIC_DEPTH limit of 1024.
Restrict broker exposure so that only authenticated and trusted clients can reach the MQTT listener from untrusted networks.
Review broker authentication and ACL configuration to ensure anonymous SUBSCRIBE and PUBLISH are disabled where not required.

Patch Information

The fix is delivered in Moquette v0.18.1. See the GitHub Security Advisory GHSA-5f42-97gr-vfhq for advisory metadata and the upstream commit ca17e0b for the code change that introduces MAX_TOPIC_DEPTH and the oversize filter check in MQTTConnection.

Workarounds

Place an MQTT-aware proxy or gateway in front of Moquette that rejects packets whose topic depth exceeds a configured maximum.
Apply network segmentation and firewall rules to limit broker reachability to known client subnets.
If upgrading is not immediately possible, increase JVM stack size with -Xss only as a temporary buffer; this does not remove the vulnerability and still permits a crash at higher depths.

bash

# Upgrade Moquette dependency in Maven pom.xml to the patched version
# <dependency>
#     <groupId>io.moquette</groupId>
#     <artifactId>moquette-broker</artifactId>
#     <version>0.18.1</version>
# </dependency>

mvn versions:use-dep-version -Dincludes=io.moquette:moquette-broker -DdepVersion=0.18.1 -DforceVersion=true
mvn clean verify