https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-95848.htmlhttps://patchthecve.com/cve/CVE-2026-95848.htmlMon, 28 Sep 2026 15:23:06 +0000CRITICAL 9.1: Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured authenticator or authorizator class cannot be loaded, Server.initializeAuthenticator and Server.initializeAuthorizatorPolicy treat the failure as though no custom class was configured and fall back to AcceptAllAuthenticathttps://patchthecve.com/cve/CVE-2026-95847.htmlhttps://patchthecve.com/cve/CVE-2026-95847.htmlMon, 28 Sep 2026 15:23:24 +0000HIGH 7.5: Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, H2PersistentQueue derives a session's message-map name as queue_ plus the client ID and its metadata-map name as queue_ plus the client ID plus _meta. A durable session whose client ID ends in _meta can therefore make its message map collihttps://patchthecve.com/cve/CVE-2026-95846.htmlhttps://patchthecve.com/cve/CVE-2026-95846.htmlFri, 25 Sep 2026 13:34:02 +0000HIGH 7.5: Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will message without applying the canWrite authorization and reserved-topic checks used for a normal PUBLISH. A client can configure a Will for a topic that the client is not permitted to wrhttps://patchthecve.com/cve/CVE-2026-95845.htmlhttps://patchthecve.com/cve/CVE-2026-95845.htmlFri, 25 Sep 2026 13:34:37 +0000HIGH 7.5: Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, the broker does not enforce a maximum length for pending per-session message queues. When a fast publisher sends messages to a slow subscriber whose in-flight window is full, queued messages can accumulate without bound in memory or persishttps://patchthecve.com/cve/CVE-2026-95844.htmlhttps://patchthecve.com/cve/CVE-2026-95844.htmlTue, 29 Sep 2026 02:16:55 +0000HIGH 7.5: Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, Moquette does not limit the depth of topic names and topic filters before processing them through recursive CTrie insertion and matching operations. A remote client can publish or subscribe with a deeply nested topic, causing a StackOverflhttps://patchthecve.com/cve/CVE-2026-95843.htmlhttps://patchthecve.com/cve/CVE-2026-95843.htmlFri, 25 Sep 2026 13:34:44 +0000HIGH 7.5: Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.subscribe parses a shared-subscription filter through SharedSubscriptionUtils.extractShareName before validating the complete $share/{shareName}/{topicFilter} structure. A remote client can send a filter such as $share/grp withohttps://patchthecve.com/cve/CVE-2026-95842.htmlhttps://patchthecve.com/cve/CVE-2026-95842.htmlFri, 25 Sep 2026 13:34:50 +0000HIGH 7.5: Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, SessionEventLoop.run catches only InterruptedException, and SessionEventLoopGroup does not restart a terminated loop. An MQTT command that raises an uncaught exception can terminate an event loop shared by multiple client sessions, preventhttps://patchthecve.com/cve/CVE-2026-85724.htmlhttps://patchthecve.com/cve/CVE-2026-85724.htmlFri, 25 Sep 2026 13:34:57 +0000CRITICAL 9.6: Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username values directly into rules containing %c or %u and then treats the result as an MQTT topic filter. A client that uses +