# CVE-2026-95844: Moquette MQTT broker stack overflow via deeply nested topics

Source: https://junglewise.ai/threats/cve-2026-95844-moquette-is-a-lightweight-java-mqtt-broker-prior-to-0-18-1  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-95844 · Severity: info · Published 2026-09-23

Moquette is a lightweight Java MQTT broker that processes message subscriptions and publications. An attacker can publish or subscribe with extremely deeply nested topic names, causing a stack overflow error that crashes the broker's session handler and denies service to legitimate clients trying to use the broker.

Technologies: [Moquette](https://junglewise.ai/threats/technologies/moquette). Vendors: [Moquette](https://junglewise.ai/threats/vendors/moquette).

## Quick answers

**Is CVE-2026-95844 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-95844 being exploited in the wild.

**How severe is CVE-2026-95844?** Informational severity, published 23 September 2026.

**Which products and versions are affected?** Moquette prior to 0.18.1.

**Is there a fix for CVE-2026-95844?** A patch was published on 2026-08-01: Fixed in version 0.18.1 released on August 1, 2026 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-95844 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-95844?** Check whether you run Moquette at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The broker does not enforce a maximum nesting depth on MQTT topic names or filters before processing them through recursive CTrie insertion and matching operations. A remote, unauthenticated client can trigger a StackOverflowError by publishing or subscribing to a topic with excessive depth, disrupting the session event loop. The fix introduces a configurable MAX_TOPIC_DEPTH limit (default 1024) enforced at publish, subscribe, and SubscriptionDirectory entry points.

## Affected products

- Moquette Moquette prior to 0.18.1

## Timeline

- 2026-09-23: disclosed
- 2026-08-01: patched: Fixed in version 0.18.1 released on August 1, 2026

## References

- [https://github.com/moquette-io/moquette/commit/ca17e0be19e86d5e291f4532dfdc94616c8e0049](https://github.com/moquette-io/moquette/commit/ca17e0be19e86d5e291f4532dfdc94616c8e0049)
- [https://github.com/moquette-io/moquette/releases/tag/v0.18.1](https://github.com/moquette-io/moquette/releases/tag/v0.18.1)

## Related threats

- [Moquette H2PersistentQueue client ID collision in durable sessions](https://junglewise.ai/threats/cve-2026-95847-moquette-is-a-lightweight-java-mqtt-broker-prior-to-0-18-1)
- [Moquette Last-Will authorization bypass](https://junglewise.ai/threats/cve-2026-95846-moquette-is-a-lightweight-java-mqtt-broker-prior-to-0-18-1)
- [Moquette unbounded message queue denial of service](https://junglewise.ai/threats/cve-2026-95845-moquette-is-a-lightweight-java-mqtt-broker-prior-to-0-18-1-the)
- [Moquette MQTT broker denial of service in shared subscription parsing](https://junglewise.ai/threats/cve-2026-95843-moquette-is-a-lightweight-java-mqtt-broker-prior-to-0-18-1)
- [Moquette MQTT broker event loop denial of service](https://junglewise.ai/threats/cve-2026-95842-moquette-is-a-lightweight-java-mqtt-broker-prior-to-0-18-1)