moquette has 9 CVEs on record. Disclosure cadence is accelerating: 9 in the last 90 days against 0 in the 90 before. The busiest recent month was September 2026 with 9. The median CVSS is 7.5 (high), with 2 rated critical. None have a confirmed exploitation report. Most affected products: moquette (8), io.moquette:moquette-broker (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- —
- Last 90 days
- 9 prev 0
Products
- moquette 8
- io.moquette:moquette-broker 1
Worst active — by depth score
CVE-2026-85724Critical· 9.6Moquette is a lightweight Java MQTT broker65CVE-2026-95848Critical· 9.1Moquette is a lightweight Java MQTT broker62CVE-2026-95847High· 7.5Moquette is a lightweight Java MQTT broker53CVE-2026-95846High· 7.5Moquette is a lightweight Java MQTT broker53CVE-2026-95844High· 7.5Moquette is a lightweight Java MQTT broker53
moquette vulnerabilities
CVEs affecting moquette, newest first. Open any entry for full detail, references, and exploit status.
9 CVEsRSS
CVE-2026-95848Critical· 9.1PoCMoquette is a lightweight Java MQTT broker
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured authenticator or authorizator class cannot be loaded, Server.initializeAuthenticator and Server.initializeAuthorizatorPolicy treat the failure as though no cu…
CVE-2026-95847High· 7.5PoCMoquette is a lightweight Java MQTT broker
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, H2PersistentQueue derives a session's message-map name as queue_ plus the client ID and its metadata-map name as queue_ plus the client ID plus _meta. A durable session whose c…
CVE-2026-95846High· 7.5PoCMoquette is a lightweight Java MQTT broker
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will message without applying the canWrite authorization and reserved-topic checks used for a normal PUBLISH. A client can conf…
CVE-2026-95845High· 7.5Moquette is a lightweight Java MQTT broker
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, the broker does not enforce a maximum length for pending per-session message queues. When a fast publisher sends messages to a slow subscriber whose in-flight window is full, q…
CVE-2026-95844High· 7.5PoCMoquette is a lightweight Java MQTT broker
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, Moquette does not limit the depth of topic names and topic filters before processing them through recursive CTrie insertion and matching operations. A remote client can publish…
CVE-2026-95843High· 7.5PoCMoquette is a lightweight Java MQTT broker
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.subscribe parses a shared-subscription filter through SharedSubscriptionUtils.extractShareName before validating the complete $share/{shareName}/{topicFilter} struct…
CVE-2026-95842High· 7.5PoCMoquette is a lightweight Java MQTT broker
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, SessionEventLoop.run catches only InterruptedException, and SessionEventLoopGroup does not restart a terminated loop. An MQTT command that raises an uncaught exception can term…
CVE-2026-85724Critical· 9.6PoCMoquette is a lightweight Java MQTT broker
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username values directly into rules containing %c or %u and then t…
CVE-2026-85058High· 7.5PoCMoquette is a lightweight Java MQTT broker
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client-controlled Last Will message through publish2Subscribers without invoking the authorizator.canWrite check used by normal PUBLISH paths…