Vulnerabilities in moquette-io

9 results

Vexday analysis

Moquette-io possui apenas 1 vulnerabilidade registrada na base, relacionada a controle de acesso (CWE-862), publicada recentemente nos últimos 90 dias. Nenhuma criticidade máxima foi identificada e não há evidências de exploração ativa em ataques conhecidos, o que reduz o risco imediato para usuários da biblioteca.

CVE-2026-85058HIGHMoquette: Missing Authorization in io.moquette:moquette-brokerEPSS 0.3%CVE-2026-95848CRITICALMoquette fails open when configured authentication or authorization classes cannot loadEPSS —CVE-2026-95844HIGHMoquette deeply nested MQTT topics can cause stack exhaustionEPSS —CVE-2026-95843HIGHMoquette malformed shared subscriptions can crash command processingEPSS —CVE-2026-85724CRITICALMoquette pattern ACL wildcard injection allows cross-tenant authorization bypassEPSS —CVE-2026-95847HIGHMoquette client IDs can cause cross-session H2 durable-queue corruptionEPSS —CVE-2026-95846HIGHMoquette publishes Last-Will messages without enforcing write authorizationEPSS —CVE-2026-95845HIGHMoquette unbounded per-session message queues allow memory exhaustionEPSS —CVE-2026-95842HIGHMoquette uncaught MQTT command exceptions can terminate shared session event loopsEPSS —