Moquette CVE-2026-95843

No special conditions beyond network reachability - Moquette accepts anonymous MQTT clients by default, so a remote unauthenticated attacker can send the malformed '$share/grp' SUBSCRIBE (a shared-subscription filter lacking the '/{topicFilter}' part) against a default configuration. Exploitation does not require the target to have any shared-subscription feature pre-configured; the crash occurs during parsing of the attacker-supplied filter. The primary limiting factor is broker exposure: the impact scales with how many other client sessions are assigned to the same shared session event loop, and the DoS affects those co-located sessions rather than necessarily every session on a large multi-loop deployment. Fixed in 0.18.1.

This is a genuine remote, pre-authentication denial-of-service against the Moquette MQTT broker. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) is internally consistent with the description: any anonymous MQTT client (Moquette accepts anonymous connections by default) can send a single malformed SUBSCRIBE and trigger the fault, with no privileges, no user interaction, and low complexity. The impact metrics correctly capture a pure availability issue (VC:N/VI:N/VA:H) - there is no confidentiality or integrity impact from THIS specific flaw, so the score of 8.7 rests entirely on availability. The GHSA advisory explains WHY the DoS is severe: SessionEventLoop catches only InterruptedException and is never restarted, so the uncaught StringIndexOutOfBoundsException wedges every client session co-located on that event loop, not just the attacker's. No EPSS score or CISA KEV entry is present in the input, so there is no evidence of active exploitation or widespread automated scanning; however, the trigger is trivial and source-level PoCs are published in the advisory. The 'Information Disclosure' tag in the input is contradicted by the CVSS impact metrics (VC:N) and the description - this is availability-only, and the tag should be disregarded. Overall this is a real, easy-to-trigger DoS worth prompt patching for internet-exposed brokers, though the affected product's niche footprint tempers absolute urgency.

An unauthenticated attacker connects to an exposed Moquette broker (anonymous connections are the default) and sends a SUBSCRIBE packet containing the malformed shared-subscription filter '$share/grp' with no topic-filter portion. SharedSubscriptionUtils.extractShareName evaluates substring(7,-1), throwing StringIndexOutOfBoundsException on the shared session event loop, which is never restarted and thereby denies service to all other client sessions assigned to that loop. Source-level PoCs for the vulnerability cluster are published in the GHSA advisory and a regression unit test accompanies the fix, making reproduction trivial.