# CVE-2026-95843: Moquette MQTT broker denial of service in shared subscription parsing

Source: https://junglewise.ai/threats/cve-2026-95843-moquette-is-a-lightweight-java-mqtt-broker-prior-to-0-18-1  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-95843 · Severity: high · CVSS 7.5 · Published 2026-09-23

Moquette is a lightweight Java MQTT broker that handles real-time message distribution. A remote attacker can send a malformed shared-subscription message that causes the broker to crash with an unhandled exception, taking down the entire session event loop and disconnecting other clients on that loop. This is a denial-of-service vulnerability requiring only network access to the MQTT port with no authentication required.

Technologies: [Moquette](https://junglewise.ai/threats/technologies/moquette), [Moquette-Io Moquette](https://junglewise.ai/threats/technologies/moquette-io-moquette). Vendors: [Moquette](https://junglewise.ai/threats/vendors/moquette), [Moquette-Io](https://junglewise.ai/threats/vendors/moquette-io).

## Quick answers

**Is CVE-2026-95843 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-95843 being exploited in the wild.

**How severe is CVE-2026-95843?** High severity, with a CVSS score of 7.5, published 23 September 2026.

**Which products and versions are affected?** Moquette-Io Moquette before 0.18.1.

**Is there a fix for CVE-2026-95843?** A patch was published on 2026-07-16: Fix merged in version 0.18.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-95843 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-95843?** Check whether you run Moquette or Moquette-Io Moquette at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in PostOffice.subscribe where the shared-subscription filter $share/{shareName}/{topicFilter} is parsed before complete validation. An attacker sends a malformed filter like $share/grp (missing the /{topicFilter} portion), causing StringIndexOutOfBoundsException in SharedSubscriptionUtils.extractShareName when it attempts substring(7, -1). This unhandled exception crashes the command-handling event loop thread, affecting all other clients using that shared session loop. The fix validates the complete $share structure upfront and disconnects malformed clients per MQTT-4.13.1-1.

## Affected products

- moquette-io Moquette before 0.18.1

## Timeline

- 2026-09-23: disclosed
- 2026-07-16: patched: Fix merged in version 0.18.1

## References

- [https://github.com/moquette-io/moquette/commit/affdc71fdba92dc020421678970ae70518fb6da2](https://github.com/moquette-io/moquette/commit/affdc71fdba92dc020421678970ae70518fb6da2)
- [https://github.com/moquette-io/moquette/pull/962](https://github.com/moquette-io/moquette/pull/962)

## Related threats

- [Moquette MQTT broker insecure fallback on authenticator load failure](https://junglewise.ai/threats/cve-2026-95848-moquette-is-a-lightweight-java-mqtt-broker-prior-to-0-18-1-when-a)
- [Moquette H2PersistentQueue client ID collision in durable sessions](https://junglewise.ai/threats/cve-2026-95847-moquette-is-a-lightweight-java-mqtt-broker-prior-to-0-18-1)
- [Moquette Last-Will authorization bypass](https://junglewise.ai/threats/cve-2026-95846-moquette-is-a-lightweight-java-mqtt-broker-prior-to-0-18-1)
- [Moquette unbounded message queue denial of service](https://junglewise.ai/threats/cve-2026-95845-moquette-is-a-lightweight-java-mqtt-broker-prior-to-0-18-1-the)
- [Moquette MQTT broker stack overflow via deeply nested topics](https://junglewise.ai/threats/cve-2026-95844-moquette-is-a-lightweight-java-mqtt-broker-prior-to-0-18-1)