CVE-2026-95843: Moquette malformed shared subscriptions can crash command processing
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.subscribe parses a shared-subscription filter through SharedSubscriptionUtils.extractShareName before validating the complete $share/{shareName}/{topicFilter} structure. A remote client can send a filter such as $share/grp without a topic-filter portion, causing a StringIndexOutOfBoundsException while calculating the share name. The exception terminates command handling on the shared session event loop and can deny service to other client sessions assigned to that loop. This issue is fixed in version 0.18.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Moquetteto a version that resolves this vulnerability.Fixed in 0.18.1
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote MQTT client that can send a subscription filter to the broker can trigger it. The client does not need to provide a valid shared-subscription filter; a value such as "$share/grp" is sufficient.
What is the operational impact of a successful trigger?
The malformed filter causes a StringIndexOutOfBoundsException during command handling. This terminates processing on the affected shared session event loop and can deny service to other client sessions assigned to that loop.
Which versions are affected and what is the remediation?
Moquette versions prior to 0.18.1 are affected. Upgrade to version 0.18.1, which fixes the validation order for shared-subscription filters.