CVE-2026-95843: Moquette MQTT broker denial of service in shared subscription parsing

CVE-2026-95843 · Severity: high · CVSS 7.5 · Published 2026-09-23

Moquette is a lightweight Java MQTT broker that handles real-time message distribution. A remote attacker can send a malformed shared-subscription message that causes the broker to crash with an unhandled exception, taking down the entire session event loop and disconnecting other clients on that loop. This is a denial-of-service vulnerability requiring only network access to the MQTT port with no authentication required.

Technologies: Moquette, Moquette-Io Moquette. Vendors: Moquette, Moquette-Io.

Quick answers

Is CVE-2026-95843 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-95843 being exploited in the wild.
How severe is CVE-2026-95843?
High severity, with a CVSS score of 7.5, published 23 September 2026.
Which products and versions are affected?
Moquette-Io Moquette before 0.18.1.
Is there a fix for CVE-2026-95843?
A patch was published on 2026-07-16: Fix merged in version 0.18.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-95843 attacked?
It is attacked over the network.
Am I affected by CVE-2026-95843?
Check whether you run Moquette or Moquette-Io Moquette at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in PostOffice.subscribe where the shared-subscription filter $share/{shareName}/{topicFilter} is parsed before complete validation. An attacker sends a malformed filter like $share/grp (missing the /{topicFilter} portion), causing StringIndexOutOfBoundsException in SharedSubscriptionUtils.extractShareName when it attempts substring(7, -1). This unhandled exception crashes the command-handling event loop thread, affecting all other clients using that shared session loop. The fix validates the complete $share structure upfront and disconnects malformed clients per MQTT-4.13.1-1.

Affected products

  • moquette-io Moquette before 0.18.1

Timeline

  • 2026-09-23: disclosed
  • 2026-07-16: patched: Fix merged in version 0.18.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.