CVE-2026-95843

Name of the Vulnerable Software and Affected Versions Moquette versions prior to 0.18.1

Description An issue exists where the PostOffice.subscribe function parses a shared-subscription filter using SharedSubscriptionUtils.extractShareName before validating the full $share/{shareName}/{topicFilter} structure. A remote client can trigger a StringIndexOutOfBoundsException by sending a filter like $share/grp that lacks the topic-filter portion. This exception terminates command handling on the shared session event loop, resulting in a denial of service for other client sessions assigned to that loop.

Recommendations Update to version 0.18.1.