The Moquette MQTT broker is vulnerable to a remote denial of service attack that can be triggered by unauthenticated clients via specially crafted topic names.

The application fails to limit the depth of topic names and filters, leading to uncontrolled recursion during CTrie insertion and matching. An unauthenticated attacker can exploit this by publishing or subscribing to deeply nested topics to crash the broker session.

Successful exploitation of this vulnerability results in a denial of service, which can cause significant disruption to IoT communication flows and real time data processing. With a CVSS score of 8.7, this high severity flaw poses a substantial risk to operational availability, particularly in environments reliant on the MQTT protocol for critical infrastructure monitoring or control.

Immediate Action: Update to Moquette version 0.18.1 or later, which includes the necessary depth limits to prevent recursive stack overflows.

Proactive Monitoring: Monitor broker logs for frequent session terminations or unexpected service restarts which may indicate attempts to trigger the StackOverflowError.

Compensating Controls: Implement strict topic length and nesting depth validation at the gateway or firewall level if an immediate software update is not feasible.

Public Exploit Available: No (unknown)

Given the ease of triggering this denial of service condition without authentication, organizations should prioritize the update to version 0.18.1. Failure to patch may result in intermittent or total service outages, which can severely impact mission critical messaging systems.