Executive brief
Moquette is a lightweight Java MQTT broker that handles real-time message distribution. A remote attacker can send a malformed shared-subscription message that causes the broker to crash with an unhandled exception, taking down the entire session event loop and disconnecting other clients on that loop. This is a denial-of-service vulnerability requiring only network access to the MQTT port with no authentication required.
Technical details
The vulnerability exists in PostOffice.subscribe where the shared-subscription filter $share/{shareName}/{topicFilter} is parsed before complete validation. An attacker sends a malformed filter like $share/grp (missing the /{topicFilter} portion), causing StringIndexOutOfBoundsException in SharedSubscriptionUtils.extractShareName when it attempts substring(7, -1). This unhandled exception crashes the command-handling event loop thread, affecting all other clients using that shared session loop. The fix validates the complete $share structure upfront and disconnects malformed clients per MQTT-4.13.1-1.
Affected products
- moquette-io Moquette before 0.18.1
Timeline
- 2026-09-23: disclosed
- 2026-07-16: patched: Fix merged in version 0.18.1