Moquette, a lightweight Java MQTT broker, processes MQTT topic names and topic filters through recursive CTrie operations without limiting their depth. A remote client can publish or subscribe using a deeply nested topic, triggering a StackOverflowError during these recursive operations. The error disrupts session processing and can render the broker unavailable to its clients, creating a denial‑of‑service scenario for all connected users.

The vulnerability affects the moquette-io:moquette broker, specifically any release prior to version 0.18.1. Users deploying older Moquette versions are at risk. Upgrading to 0.18.1 or newer mitigates the issue.

The CVSS score of 8.7 indicates high severity, while the EPSS score is not available, giving no precise estimate of current exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. The attack vector is remote; any client capable of publishing or subscribing to the broker can introduce a deeply nested topic and trigger the stack exhaustion. No special environment or privileged access is required beyond normal broker usage.