These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-95846 is a high-severity vulnerability in Moquette, a lightweight Java MQTT broker. The issue allows unauthorized message injection into restricted topics due to a lack of canWrite authorization and reserved-topic checks for Last-Will messages. This affects Moquette versions prior to 0.18.1. The vulnerability was published on 2026-09-23T17:17:21.627Z and last modified on 2026-09-25T13:34:02.580Z.
A denial-of-service vulnerability exists in Moquette, a lightweight Java MQTT broker, prior to version 0.18.1. The broker does not enforce a maximum length for pending per-session message queues. When a fast publisher sends messages to a slow subscriber whose in-flight window is full, queued messages can accumulate without bound in memory or persistent storage. This issue allows remote clients to exhaust [truncated]
CVE-2026-95843 debrief: Moquette MQTT broker vulnerability allows remote denial of service via malformed shared subscription filter. The issue arises from the PostOffice.subscribe method parsing a shared-subscription filter through SharedSubscriptionUtils.extractShareName before validating the complete $share/{shareName}/{topicFilter} structure. This can lead to a StringIndexOutOfBoundsException, terminat [truncated]
CVE-2026-95842 debrief based on the supplied source corpus. The CVE record was published on 2026-09-23T17:17:20.970Z and has not been modified since then. The NVD entry is currently Analyzed. The vulnerability affects Moquette MQTT broker deployments, particularly those using versions prior to 0.18.1, allowing an attacker to disrupt session processing for co-located clients. This disruption can impact ava [truncated]
A critical vulnerability in Moquette, a lightweight Java MQTT broker, allows unauthorized access to MQTT topics due to improper handling of pattern-based ACL rules. This issue, fixed in version 0.18.1, enables clients to broaden their access and potentially disrupt session processing. The vulnerability arises from the AuthorizationsCollector.canDoOperation method directly substituting client ID and userna [truncated]