CVE-2026-95843
Received Received - Intake

Denial of Service in Moquette MQTT Broker

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.subscribe parses a shared-subscription filter through SharedSubscriptionUtils.extractShareName before validating the complete $share/{shareName}/{topicFilter} structure. A remote client can send a filter such as $share/grp without a topic-filter portion, causing a StringIndexOutOfBoundsException while calculating the share name. The exception terminates command handling on the shared session event loop and can deny service to other client sessions assigned to that loop. This issue is fixed in version 0.18.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-95843
EUVD
EUVD-2026-85413

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
moquette moquette to 0.18.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a denial-of-service (DoS) vulnerability in the Moquette MQTT broker affecting versions before 0.18.1. A remote attacker can send a malformed shared subscription filter like $share/grp without a topic filter part. This causes a StringIndexOutOfBoundsException during parsing, crashing the shared session event loop and disrupting service for other clients using that loop.

Detection Guidance

Monitor for malformed MQTT shared subscription requests like $share/grp without a topic filter. Check Moquette broker logs for StringIndexOutOfBoundsException errors in shared session event loops. Use network traffic analysis tools to inspect MQTT packets for invalid $share/{shareName} structures.

Impact Analysis

If exploited, this vulnerability can cause the MQTT broker to crash or become unresponsive, denying service to legitimate clients connected through the affected shared session event loop. This may lead to interrupted messaging, lost connections, or degraded performance for all users sharing that broker resource.

Mitigation Strategies

Upgrade Moquette to version 0.18.1 or later to apply the fix. If upgrading is not immediately possible, implement network-level filtering to block malformed MQTT shared subscription requests before they reach the broker.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-95843. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart