CVE-2026-95843 in Moquette
Summary
by MITRE • 09/23/2026
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.subscribe parses a shared-subscription filter through SharedSubscriptionUtils.extractShareName before validating the complete $share/{shareName}/{topicFilter} structure. A remote client can send a filter such as $share/grp without a topic-filter portion, causing a StringIndexOutOfBoundsException while calculating the share name. The exception terminates command handling on the shared session event loop and can deny service to other client sessions assigned to that loop. This issue is fixed in version 0.18.1.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified in Moquette, a lightweight Java-based MQTT broker, represents a critical input validation failure within its message routing infrastructure. Specifically, the flaw resides in the PostOffice.subscribe method which handles shared subscriptions, a feature designed to allow multiple clients to receive messages from the same topic by distributing load across subscribers. Prior to version 0.18.1, the system processes incoming subscription requests by attempting to extract share names using SharedSubscriptionUtils.extractShareName before performing comprehensive validation of the complete subscription filter structure. This ordering of operations creates a logic error where malformed input triggers an internal exception rather than being rejected gracefully as invalid data.
The technical root cause is a StringIndexOutOfBoundsException resulting from improper boundary checking during string manipulation. When a remote client sends a shared-subscription filter that lacks the required topic-filter portion, such as $share/grp instead of the expected format $share/{shareName}/{topicFilter}, the extraction utility attempts to access characters in the string at indices that do not exist. Because this exception is not caught within the command handling logic for shared session events, it propagates up and terminates the execution thread responsible for processing commands on that specific event loop. This behavior transforms a simple malformed message into a potent denial-of-service vector against the broker's internal threading model.
The operational impact of this vulnerability extends beyond the single client sending the malicious payload. Since Moquette utilizes an event-loop architecture to handle multiple concurrent connections, the termination of one command handling thread disrupts all other client sessions assigned to that same loop. This means a remote attacker can cause a cascading failure where legitimate users experience service interruption or disconnection without any direct interaction with their own accounts. The severity is heightened by the fact that MQTT brokers often serve as critical infrastructure for Internet of Things deployments and real-time data streaming, making availability paramount. An unauthenticated attacker could exploit this flaw to degrade system reliability significantly.
This vulnerability aligns with CWE-20 Improper Input Validation, as the application fails to verify that user-supplied input conforms to expected structural requirements before processing it. Furthermore, from a threat modeling perspective consistent with MITRE ATT&CK techniques, this represents an impact on availability through resource exhaustion or service disruption, specifically leveraging improper handling of exceptional conditions within network-facing services. The attack vector is remote and requires no authentication if the broker allows anonymous subscriptions, which is common in many IoT configurations.
Mitigation strategies primarily involve upgrading to Moquette version 0.18.1 or later, where this logic error has been corrected by ensuring proper validation precedes string manipulation operations. For organizations unable to immediately patch their systems, implementing a network-level filter such as an intrusion prevention system can help block malformed MQTT packets containing incomplete shared subscription filters before they reach the broker application layer. Additionally, configuring the broker to restrict anonymous access and enforcing strict topic filtering policies at the perimeter can reduce the attack surface available for exploitation of this specific flaw.