Moquette
Monthly
Moquette MQTT brokers prior to 0.18.1 can start up with authentication and authorization silently disabled whenever a configured authenticator_class or authorizator_class fails to load, so any remote client - including anonymous MQTT clients, since the broker is anonymous by default - can read and write every topic the broker handles while the operator believes access controls are active. The flaw is not directly attacker-triggered: it requires a deployment that both intends to enforce auth and has a broken class-load (misspelled class name, missing dependency, constructor failure, or classpath problem), which is why the independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N even though the end-state is a full confidentiality and integrity break; the vendor's CVSS 4.0 vector is 9.3. No public exploit for this fail-open condition was identified at time of analysis, and no CISA KEV entry is present; version 0.18.1 fixes the issue by aborting startup instead of falling back to permissive defaults.
Durable MQTT sessions in Moquette 0.18.0 and earlier can corrupt each other's persisted queues when a client connects with an identifier ending in '_meta', allowing cross-session message loss, misdelivery, or exposure of queued content. The flaw only exists when the broker is configured with H2 MVStore-backed durable/persistent sessions, and the attacker must use a client ID shaped like '<victim_client_id>_meta', so some knowledge or predictability of a target client ID is required; Moquette accepts anonymous clients by default, so authentication is not necessarily a barrier (assessed CVSS 3.1 AV:N/AC:H/PR:N/UI:N/C:L/I:H/A:L). The impact is integrity-dominant with limited confidentiality loss - this is a JVM memory-safe broker and no RCE is involved; the upstream advisory that covers this bug also ships source-only PoC code for a companion pattern-ACL bypass, but no public exploit identified at time of analysis and no CISA KEV listing. The issue is fixed in Moquette 0.18.1.
Unauthorized message injection in the Moquette lightweight Java MQTT broker affects all releases prior to 0.18.1: PostOffice.publishWill publishes a client's Last-Will Testament without running the canWrite authorization and reserved-topic checks that gate a normal PUBLISH, so remote unauthenticated attackers (CVSS vector PR:N) can register a Will on a topic they are not allowed to write and have the broker deliver that message to subscribers when the connection is abruptly dropped. This is an integrity-only flaw (C:N/I:H/A:N) whose real-world severity depends on how sensitive the restricted topic is - for example device command-and-control channels - and exploitation requires that an ACL or IAuthorizatorPolicy actually restricts writes to the targeted topic; vendors score it 8.7 (CVSS 4.0). Publicly available exploit code exists (the upstream advisory ships source-level PoCs, including a wildcard-ACL injection proof), but there is no indication in the supplied data of confirmed active exploitation (CISA KEV), and no patch is available other than upgrading to vendor-released version 0.18.1.
Unbounded per-session message queuing in Moquette MQTT Broker before 0.18.1 permits remote unauthenticated clients to exhaust broker memory or persistent storage by sustaining a fast publisher against a slow subscriber, causing denial of service. The CVSS 4.0 base score is 8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N), consistent with a high-availability-only impact under CWE-770; the independent assessment CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms no confidentiality or integrity impact. Default Moquette configurations permit anonymous clients, broadening exposure, and no public exploit identified at time of analysis; no CISA KEV entry, EPSS score, or public exploit specific to this queue-exhaustion issue is provided in the input.
Remote unauthenticated clients can crash a Moquette MQTT broker running 0.18.0 or earlier by publishing or subscribing with a topic name or filter that is nested to an extreme depth, triggering uncontrolled recursion in the broker's CTrie subscription structure and an uncaught StackOverflowError. Because Moquette accepts anonymous MQTT clients by default, network reachability is the only precondition, and the resulting crash lands on a SessionEventLoop that catches only InterruptedException and is never restarted, so the failure wedges every session co-located on that loop rather than just the attacker's connection - a broker-wide denial of service with high availability impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; vendor-published CVSS 4.0 base 8.7). The issue is not in CISA KEV and no public exploit identified at time of analysis; it is fixed in Moquette 0.18.1, which introduces a MAX_TOPIC_DEPTH of 1024 enforced on both PUBLISH and SUBSCRIBE paths.
Remote, pre-authentication denial of service in the Moquette MQTT broker (moquette-io moquette-broker) through 0.18.0 allows any client able to reach the MQTT listener to wedge the broker's session event loop by sending a malformed shared-subscription filter such as '$share/grp' that omits the '/{topicFilter}' portion. Because the exception is thrown while building the subscription and the SessionEventLoop only catches InterruptedException and is never restarted, command handling on that loop stops and every other client session assigned to the same loop is denied service; the network vector is unauthenticated (CVSS 4.0 AV:N/AC:L/PR:N/UI:N with VA:H, score 8.7; vendor-assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Moquette accepts anonymous MQTT clients by default and the target does not need shared subscriptions pre-configured for the crash to occur, so exploitation requires only network reachability; publicly available exploit code exists in the form of source-level proof-of-concept tests published with the advisory, but there is no indication of active exploitation (not in CISA KEV).
Denial of service in the Moquette lightweight Java MQTT broker prior to 0.18.1: a single remote, unauthenticated MQTT client can terminate a shared SessionEventLoop with a command that raises an uncaught exception, and because SessionEventLoopGroup never restarts a dead loop, every other client session pinned to that loop stops processing PUBLISH, SUBSCRIBE, PUBACK and related commands. Because Moquette accepts anonymous MQTT clients by default and the CVSS vector (PR:N) confirms no authentication is required, an attacker who chooses client IDs that distribute across the broker's available loops can progressively disable session processing broker-wide; impact is availability-only (C:N/I:N/A:H, no code execution or data exposure), and the upstream advisory documents concrete trigger inputs such as a malformed $share/grp SUBSCRIBE, a deeply nested topic, and an ACL NPE. No public exploit tooling was identified at time of analysis, and the issue is fixed in 0.18.1.
Moquette MQTT brokers running versions prior to 0.18.1 fail to enforce topic write ACLs on Last Will and Testament messages, letting a remote, unauthenticated client (CVSS vector contains PR:N) publish attacker-controlled payloads into ACL-protected topics it is not permitted to write to. The attacker sets a restricted topic as the Will Topic in the CONNECT packet and then drops the connection abnormally (for example with a TCP RST) so the broker fires the Will through PostOffice.publishWill() → publish2Subscribers() without ever calling authorizator.canWrite(), the check that guards normal QoS 0/1/2 PUBLISH paths. The published CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N); our independent assessment concurs on network reachability, no privileges and no user interaction, with integrity-only impact, though it rates the per-event integrity effect as low because each bypass delivers only a single message (repeatable by reconnecting). No public exploit code and no confirmed active exploitation were identified at time of analysis; the issue is fixed in 0.18.1.
Moquette MQTT brokers prior to 0.18.1 can start up with authentication and authorization silently disabled whenever a configured authenticator_class or authorizator_class fails to load, so any remote client - including anonymous MQTT clients, since the broker is anonymous by default - can read and write every topic the broker handles while the operator believes access controls are active. The flaw is not directly attacker-triggered: it requires a deployment that both intends to enforce auth and has a broken class-load (misspelled class name, missing dependency, constructor failure, or classpath problem), which is why the independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N even though the end-state is a full confidentiality and integrity break; the vendor's CVSS 4.0 vector is 9.3. No public exploit for this fail-open condition was identified at time of analysis, and no CISA KEV entry is present; version 0.18.1 fixes the issue by aborting startup instead of falling back to permissive defaults.
Durable MQTT sessions in Moquette 0.18.0 and earlier can corrupt each other's persisted queues when a client connects with an identifier ending in '_meta', allowing cross-session message loss, misdelivery, or exposure of queued content. The flaw only exists when the broker is configured with H2 MVStore-backed durable/persistent sessions, and the attacker must use a client ID shaped like '<victim_client_id>_meta', so some knowledge or predictability of a target client ID is required; Moquette accepts anonymous clients by default, so authentication is not necessarily a barrier (assessed CVSS 3.1 AV:N/AC:H/PR:N/UI:N/C:L/I:H/A:L). The impact is integrity-dominant with limited confidentiality loss - this is a JVM memory-safe broker and no RCE is involved; the upstream advisory that covers this bug also ships source-only PoC code for a companion pattern-ACL bypass, but no public exploit identified at time of analysis and no CISA KEV listing. The issue is fixed in Moquette 0.18.1.
Unauthorized message injection in the Moquette lightweight Java MQTT broker affects all releases prior to 0.18.1: PostOffice.publishWill publishes a client's Last-Will Testament without running the canWrite authorization and reserved-topic checks that gate a normal PUBLISH, so remote unauthenticated attackers (CVSS vector PR:N) can register a Will on a topic they are not allowed to write and have the broker deliver that message to subscribers when the connection is abruptly dropped. This is an integrity-only flaw (C:N/I:H/A:N) whose real-world severity depends on how sensitive the restricted topic is - for example device command-and-control channels - and exploitation requires that an ACL or IAuthorizatorPolicy actually restricts writes to the targeted topic; vendors score it 8.7 (CVSS 4.0). Publicly available exploit code exists (the upstream advisory ships source-level PoCs, including a wildcard-ACL injection proof), but there is no indication in the supplied data of confirmed active exploitation (CISA KEV), and no patch is available other than upgrading to vendor-released version 0.18.1.
Unbounded per-session message queuing in Moquette MQTT Broker before 0.18.1 permits remote unauthenticated clients to exhaust broker memory or persistent storage by sustaining a fast publisher against a slow subscriber, causing denial of service. The CVSS 4.0 base score is 8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N), consistent with a high-availability-only impact under CWE-770; the independent assessment CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms no confidentiality or integrity impact. Default Moquette configurations permit anonymous clients, broadening exposure, and no public exploit identified at time of analysis; no CISA KEV entry, EPSS score, or public exploit specific to this queue-exhaustion issue is provided in the input.
Remote unauthenticated clients can crash a Moquette MQTT broker running 0.18.0 or earlier by publishing or subscribing with a topic name or filter that is nested to an extreme depth, triggering uncontrolled recursion in the broker's CTrie subscription structure and an uncaught StackOverflowError. Because Moquette accepts anonymous MQTT clients by default, network reachability is the only precondition, and the resulting crash lands on a SessionEventLoop that catches only InterruptedException and is never restarted, so the failure wedges every session co-located on that loop rather than just the attacker's connection - a broker-wide denial of service with high availability impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; vendor-published CVSS 4.0 base 8.7). The issue is not in CISA KEV and no public exploit identified at time of analysis; it is fixed in Moquette 0.18.1, which introduces a MAX_TOPIC_DEPTH of 1024 enforced on both PUBLISH and SUBSCRIBE paths.
Remote, pre-authentication denial of service in the Moquette MQTT broker (moquette-io moquette-broker) through 0.18.0 allows any client able to reach the MQTT listener to wedge the broker's session event loop by sending a malformed shared-subscription filter such as '$share/grp' that omits the '/{topicFilter}' portion. Because the exception is thrown while building the subscription and the SessionEventLoop only catches InterruptedException and is never restarted, command handling on that loop stops and every other client session assigned to the same loop is denied service; the network vector is unauthenticated (CVSS 4.0 AV:N/AC:L/PR:N/UI:N with VA:H, score 8.7; vendor-assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Moquette accepts anonymous MQTT clients by default and the target does not need shared subscriptions pre-configured for the crash to occur, so exploitation requires only network reachability; publicly available exploit code exists in the form of source-level proof-of-concept tests published with the advisory, but there is no indication of active exploitation (not in CISA KEV).
Denial of service in the Moquette lightweight Java MQTT broker prior to 0.18.1: a single remote, unauthenticated MQTT client can terminate a shared SessionEventLoop with a command that raises an uncaught exception, and because SessionEventLoopGroup never restarts a dead loop, every other client session pinned to that loop stops processing PUBLISH, SUBSCRIBE, PUBACK and related commands. Because Moquette accepts anonymous MQTT clients by default and the CVSS vector (PR:N) confirms no authentication is required, an attacker who chooses client IDs that distribute across the broker's available loops can progressively disable session processing broker-wide; impact is availability-only (C:N/I:N/A:H, no code execution or data exposure), and the upstream advisory documents concrete trigger inputs such as a malformed $share/grp SUBSCRIBE, a deeply nested topic, and an ACL NPE. No public exploit tooling was identified at time of analysis, and the issue is fixed in 0.18.1.
Moquette MQTT brokers running versions prior to 0.18.1 fail to enforce topic write ACLs on Last Will and Testament messages, letting a remote, unauthenticated client (CVSS vector contains PR:N) publish attacker-controlled payloads into ACL-protected topics it is not permitted to write to. The attacker sets a restricted topic as the Will Topic in the CONNECT packet and then drops the connection abnormally (for example with a TCP RST) so the broker fires the Will through PostOffice.publishWill() → publish2Subscribers() without ever calling authorizator.canWrite(), the check that guards normal QoS 0/1/2 PUBLISH paths. The published CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N); our independent assessment concurs on network reachability, no privileges and no user interaction, with integrity-only impact, though it rates the per-event integrity effect as low because each bypass delivers only a single message (repeatable by reconnecting). No public exploit code and no confirmed active exploitation were identified at time of analysis; the issue is fixed in 0.18.1.