Changes.Watch~ upgrade verdicts ~
Free digest
CriticalPHP2Shell: is your PHP patched?

critical vulnerability

Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message authorization bypass, and a cross-session durable-corruption bug

Fix availableCritical · CVSS 9.6EPSS 0.27%

Published Sep 23, 2026 · updated Oct 19, 2026

What to do

  1. Upgrade to a fixed version: io.moquette:moquette-broker 0.18.1.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

Mavenio.moquette:moquette-broker

Vulnerable versions
<= 0.18.0
Fixed in
0.18.1

Check your project: mvn dependency:tree -Dincludes=io.moquette:moquette-broker

Sources

CWE-155 Improper Neutralization of Wildcards or Matching Symbols · CWE-863 Incorrect Authorization

← All critical vulnerabilities