CVE-2026-95843

Moquette is a lightweight Java MQTT broker.

Moquette

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.subscribe parses a shared-subscription filter through SharedSubscriptionUtils.extractShareName before validating the complete $share/{shareName}/{topicFilter} structure. A remote client can send a filter such as $share/grp without a topic-filter portion, causing a StringIndexOutOfBoundsException while calculating the share name. The exception terminates command handling on the shared session event loop…

23. Sep 2026

Ausgewertete Quellen

• NVD
  CVE-2026-95843
• GitHub
  https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq