{"schema_version":"2","view":"grouped","data":[{"id":3339,"cve_ids":["CVE-2026-95844"],"payload":{"kind":"advisory","title":"Moquette deeply nested MQTT topics can cause stack exhaustion","summary":"Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, Moquette does not limit the depth of topic names and topic filters before processing them through recursive CTrie insertion and matching operations. A remote client can publish or subscribe with a deeply nested topic, causing a StackOverflowError that disrupts session processing and can deny service to broker clients. This issue is fixed in version 0.18.1.","evidence":"cve:CVE-2026-95844","products":[{"name":{"value":"moquette","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-95844","aliases":["CVE-2026-95844"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"affected":[{"vendor":"moquette-io","product":"moquette","versions":[{"status":"affected","version":"< 0.18.1"}]}],"modified":"2026-09-29T02:02:45.779Z","provider":"cve","references":["https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq","https://github.com/moquette-io/moquette/commit/ca17e0be19e86d5e291f4532dfdc94616c8e0049","https://github.com/moquette-io/moquette/releases/tag/v0.18.1"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95844","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-29T02:02:23.767947Z"}}}],"references":[{"url":"https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T02:02:45.779Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-23T16:29:49.416Z"}}},"related_cves":[{"value":"CVE-2026-95844","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:fe4a35d4-b1ec-4233-bb91-c78335765250","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95844","advisory_id":"fe4a35d4-b1ec-4233-bb91-c78335765250","event_types":["advisory"],"published_at":"2026-10-24T21:33:53.035317+00:00","technologies":["core-cve","moquette"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-23T16:29:49.416+00:00","detail_url":"/advisories/advisory%3Afe4a35d4-b1ec-4233-bb91-c78335765250","group":{"id":"advisory:fe4a35d4-b1ec-4233-bb91-c78335765250","revision":1,"primary_event_id":3352,"change":"published","superseded_by":[],"changed":{"id":3352,"cve_ids":["CVE-2026-95844"],"payload":{"kind":"advisory","title":"Moquette deeply nested MQTT topics can cause stack exhaustion","summary":"Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, Moquette does not limit the depth of topic names and topic filters before processing them through recursive CTrie insertion and matching operations. A remote client can publish or subscribe with a deeply nested topic, causing a StackOverflowError that disrupts session processing and can deny service to broker clients. This issue is fixed in version 0.18.1.","evidence":"cve:CVE-2026-95844","products":[{"name":{"value":"moquette","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-95844","aliases":["CVE-2026-95844"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"affected":[{"vendor":"moquette-io","product":"moquette","versions":[{"status":"affected","version":"< 0.18.1"}]}],"modified":"2026-09-29T02:02:45.779Z","provider":"cve","references":["https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq","https://github.com/moquette-io/moquette/commit/ca17e0be19e86d5e291f4532dfdc94616c8e0049","https://github.com/moquette-io/moquette/releases/tag/v0.18.1"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95844","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-29T02:02:23.767947Z"}}}],"references":[{"url":"https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T02:02:45.779Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-23T16:29:49.416Z"}}},"related_cves":[{"value":"CVE-2026-95844","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:fe4a35d4-b1ec-4233-bb91-c78335765250","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95844","advisory_id":"fe4a35d4-b1ec-4233-bb91-c78335765250","event_types":["advisory"],"published_at":"2026-10-24T21:33:53.035317+00:00","technologies":["core-cve","moquette"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-23T16:29:49.416+00:00","detail_url":"/events/3352"},"members":[{"id":3352,"cve_ids":["CVE-2026-95844"],"payload":{"kind":"advisory","title":"Moquette deeply nested MQTT topics can cause stack exhaustion","summary":"Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, Moquette does not limit the depth of topic names and topic filters before processing them through recursive CTrie insertion and matching operations. A remote client can publish or subscribe with a deeply nested topic, causing a StackOverflowError that disrupts session processing and can deny service to broker clients. This issue is fixed in version 0.18.1.","evidence":"cve:CVE-2026-95844","products":[{"name":{"value":"moquette","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-95844","aliases":["CVE-2026-95844"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"affected":[{"vendor":"moquette-io","product":"moquette","versions":[{"status":"affected","version":"< 0.18.1"}]}],"modified":"2026-09-29T02:02:45.779Z","provider":"cve","references":["https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq","https://github.com/moquette-io/moquette/commit/ca17e0be19e86d5e291f4532dfdc94616c8e0049","https://github.com/moquette-io/moquette/releases/tag/v0.18.1"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95844","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-29T02:02:23.767947Z"}}}],"references":[{"url":"https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T02:02:45.779Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-23T16:29:49.416Z"}}},"related_cves":[{"value":"CVE-2026-95844","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:fe4a35d4-b1ec-4233-bb91-c78335765250","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95844","advisory_id":"fe4a35d4-b1ec-4233-bb91-c78335765250","event_types":["advisory"],"published_at":"2026-10-24T21:33:53.035317+00:00","technologies":["core-cve","moquette"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-23T16:29:49.416+00:00","detail_url":"/events/3352"}]}},{"id":1737,"cve_ids":["CVE-2026-95846"],"payload":{"kind":"advisory","title":"Moquette publishes Last-Will messages without enforcing write authorization","summary":"Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will message without applying the canWrite authorization and reserved-topic checks used for a normal PUBLISH. A client can configure a Will for a topic that the client is not permitted to write and cause the broker to publish the unauthorized message when the client disconnects unexpectedly. This issue allows unauthorized message injection into restricted topics. This issue is fixed in version 0.18.1.","evidence":"cve:CVE-2026-95846","products":[{"name":{"value":"moquette","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-95846","aliases":["CVE-2026-95846"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"affected":[{"vendor":"moquette-io","product":"moquette","versions":[{"status":"affected","version":"< 0.18.1"}]}],"modified":"2026-09-24T14:21:44.180Z","provider":"cve","references":["https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq","https://github.com/moquette-io/moquette/commit/f5a323fe782d1505c0097498cb22eb6ec6c96973","https://github.com/moquette-io/moquette/releases/tag/v0.18.1"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95846","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T14:21:37.380771Z"}}}],"references":[{"url":"https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T14:21:44.180Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-23T16:29:54.130Z"}}},"related_cves":[{"value":"CVE-2026-95846","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:50145006-e61d-4cc9-a252-676394de5b60","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95846","advisory_id":"50145006-e61d-4cc9-a252-676394de5b60","event_types":["advisory"],"published_at":"2026-10-24T21:06:18.466774+00:00","technologies":["core-cve","moquette"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-23T16:29:54.13+00:00","detail_url":"/advisories/advisory%3A50145006-e61d-4cc9-a252-676394de5b60","group":{"id":"advisory:50145006-e61d-4cc9-a252-676394de5b60","revision":1,"primary_event_id":1721,"change":"published","superseded_by":[],"changed":{"id":1721,"cve_ids":["CVE-2026-95846"],"payload":{"kind":"advisory","title":"Moquette publishes Last-Will messages without enforcing write authorization","summary":"Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will message without applying the canWrite authorization and reserved-topic checks used for a normal PUBLISH. A client can configure a Will for a topic that the client is not permitted to write and cause the broker to publish the unauthorized message when the client disconnects unexpectedly. This issue allows unauthorized message injection into restricted topics. This issue is fixed in version 0.18.1.","evidence":"cve:CVE-2026-95846","products":[{"name":{"value":"moquette","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-95846","aliases":["CVE-2026-95846"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"affected":[{"vendor":"moquette-io","product":"moquette","versions":[{"status":"affected","version":"< 0.18.1"}]}],"modified":"2026-09-24T14:21:44.180Z","provider":"cve","references":["https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq","https://github.com/moquette-io/moquette/commit/f5a323fe782d1505c0097498cb22eb6ec6c96973","https://github.com/moquette-io/moquette/releases/tag/v0.18.1"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95846","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T14:21:37.380771Z"}}}],"references":[{"url":"https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T14:21:44.180Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-23T16:29:54.130Z"}}},"related_cves":[{"value":"CVE-2026-95846","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:50145006-e61d-4cc9-a252-676394de5b60","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95846","advisory_id":"50145006-e61d-4cc9-a252-676394de5b60","event_types":["advisory"],"published_at":"2026-10-24T21:06:18.466774+00:00","technologies":["core-cve","moquette"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-23T16:29:54.13+00:00","detail_url":"/events/1721"},"members":[{"id":1721,"cve_ids":["CVE-2026-95846"],"payload":{"kind":"advisory","title":"Moquette publishes Last-Will messages without enforcing write authorization","summary":"Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will message without applying the canWrite authorization and reserved-topic checks used for a normal PUBLISH. A client can configure a Will for a topic that the client is not permitted to write and cause the broker to publish the unauthorized message when the client disconnects unexpectedly. This issue allows unauthorized message injection into restricted topics. This issue is fixed in version 0.18.1.","evidence":"cve:CVE-2026-95846","products":[{"name":{"value":"moquette","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-95846","aliases":["CVE-2026-95846"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"affected":[{"vendor":"moquette-io","product":"moquette","versions":[{"status":"affected","version":"< 0.18.1"}]}],"modified":"2026-09-24T14:21:44.180Z","provider":"cve","references":["https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq","https://github.com/moquette-io/moquette/commit/f5a323fe782d1505c0097498cb22eb6ec6c96973","https://github.com/moquette-io/moquette/releases/tag/v0.18.1"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95846","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T14:21:37.380771Z"}}}],"references":[{"url":"https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T14:21:44.180Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-23T16:29:54.130Z"}}},"related_cves":[{"value":"CVE-2026-95846","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:50145006-e61d-4cc9-a252-676394de5b60","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95846","advisory_id":"50145006-e61d-4cc9-a252-676394de5b60","event_types":["advisory"],"published_at":"2026-10-24T21:06:18.466774+00:00","technologies":["core-cve","moquette"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-23T16:29:54.13+00:00","detail_url":"/events/1721"}]}},{"id":1586,"cve_ids":["CVE-2026-85724"],"payload":{"kind":"advisory","title":"Moquette pattern ACL wildcard injection allows cross-tenant authorization bypass","summary":"Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username values directly into rules containing %c or %u and then treats the result as an MQTT topic filter. A client that uses + or # in either identity can broaden the substituted filter and gain cross-tenant read and write access. A # identity can also produce an invalid filter that triggers a NullPointerException in Topic.match and disrupts session processing. This issue is fixed in version 0.18.1.","evidence":"cve:CVE-2026-85724","products":[{"name":{"value":"moquette","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-85724","aliases":["CVE-2026-85724"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":9.6,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"moquette-io","product":"moquette","versions":[{"status":"affected","version":"< 0.18.1"}]}],"modified":"2026-09-24T14:19:04.429Z","provider":"cve","references":["https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq","https://github.com/moquette-io/moquette/commit/b4a98bb3f3425ece476ed073aa080c627c1239af","https://github.com/moquette-io/moquette/releases/tag/v0.18.1"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-85724","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-24T14:18:56.863679Z"}}}],"references":[{"url":"https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T14:19:04.429Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-23T16:29:36.296Z"}}},"related_cves":[{"value":"CVE-2026-85724","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:8fd95082-cf21-47e6-ad4d-2f9d53557813","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-85724","advisory_id":"8fd95082-cf21-47e6-ad4d-2f9d53557813","event_types":["advisory"],"published_at":"2026-10-24T21:04:42.060738+00:00","technologies":["core-cve","moquette"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-23T16:29:36.296+00:00","detail_url":"/advisories/advisory%3A8fd95082-cf21-47e6-ad4d-2f9d53557813","group":{"id":"advisory:8fd95082-cf21-47e6-ad4d-2f9d53557813","revision":1,"primary_event_id":1572,"change":"published","superseded_by":[],"changed":{"id":1572,"cve_ids":["CVE-2026-85724"],"payload":{"kind":"advisory","title":"Moquette pattern ACL wildcard injection allows cross-tenant authorization bypass","summary":"Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username values directly into rules containing %c or %u and then treats the result as an MQTT topic filter. A client that uses + or # in either identity can broaden the substituted filter and gain cross-tenant read and write access. A # identity can also produce an invalid filter that triggers a NullPointerException in Topic.match and disrupts session processing. This issue is fixed in version 0.18.1.","evidence":"cve:CVE-2026-85724","products":[{"name":{"value":"moquette","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-85724","aliases":["CVE-2026-85724"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":9.6,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"moquette-io","product":"moquette","versions":[{"status":"affected","version":"< 0.18.1"}]}],"modified":"2026-09-24T14:19:04.429Z","provider":"cve","references":["https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq","https://github.com/moquette-io/moquette/commit/b4a98bb3f3425ece476ed073aa080c627c1239af","https://github.com/moquette-io/moquette/releases/tag/v0.18.1"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-85724","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-24T14:18:56.863679Z"}}}],"references":[{"url":"https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T14:19:04.429Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-23T16:29:36.296Z"}}},"related_cves":[{"value":"CVE-2026-85724","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:8fd95082-cf21-47e6-ad4d-2f9d53557813","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-85724","advisory_id":"8fd95082-cf21-47e6-ad4d-2f9d53557813","event_types":["advisory"],"published_at":"2026-10-24T21:04:42.060738+00:00","technologies":["core-cve","moquette"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-23T16:29:36.296+00:00","detail_url":"/events/1572"},"members":[{"id":1572,"cve_ids":["CVE-2026-85724"],"payload":{"kind":"advisory","title":"Moquette pattern ACL wildcard injection allows cross-tenant authorization bypass","summary":"Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username values directly into rules containing %c or %u and then treats the result as an MQTT topic filter. A client that uses + or # in either identity can broaden the substituted filter and gain cross-tenant read and write access. A # identity can also produce an invalid filter that triggers a NullPointerException in Topic.match and disrupts session processing. This issue is fixed in version 0.18.1.","evidence":"cve:CVE-2026-85724","products":[{"name":{"value":"moquette","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-85724","aliases":["CVE-2026-85724"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":9.6,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"moquette-io","product":"moquette","versions":[{"status":"affected","version":"< 0.18.1"}]}],"modified":"2026-09-24T14:19:04.429Z","provider":"cve","references":["https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq","https://github.com/moquette-io/moquette/commit/b4a98bb3f3425ece476ed073aa080c627c1239af","https://github.com/moquette-io/moquette/releases/tag/v0.18.1"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-85724","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-24T14:18:56.863679Z"}}}],"references":[{"url":"https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T14:19:04.429Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-23T16:29:36.296Z"}}},"related_cves":[{"value":"CVE-2026-85724","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:8fd95082-cf21-47e6-ad4d-2f9d53557813","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-85724","advisory_id":"8fd95082-cf21-47e6-ad4d-2f9d53557813","event_types":["advisory"],"published_at":"2026-10-24T21:04:42.060738+00:00","technologies":["core-cve","moquette"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-23T16:29:36.296+00:00","detail_url":"/events/1572"}]}}],"next_after":3339,"next_before":1586}