Denial of Service Vulnerability in Moquette MQTT Broker

CVE-2026-95843

What is CVE-2026-95843?

Moquette is a lightweight Java MQTT broker that prior to version 0.18.1, contains a vulnerability in its subscription handling mechanism. The issue arises when the PostOffice.subscribe method parses a shared-subscription filter without adequately validating the format of the $share/{shareName}/{topicFilter} structure. A remote client can exploit this by sending an incomplete filter such as $share/grp, leading to a StringIndexOutOfBoundsException. This exception interrupts the command processing in the shared session event loop, resulting in potential denial of service for other client sessions that rely on that loop. Update to version 0.18.1 or later to mitigate this vulnerability.

References