CVE-2026-95843 moquette-io CVE debrief

Who should care

Defenders responsible for MQTT broker configurations and deployments should assess exposure and verify their Moquette versions. Operators managing Moquette MQTT brokers, platform administrators, and security teams should review and adjust configurations for secure shared subscription filters. Vulnerability management teams should prioritize verifying and upgrading to Moquette version 0.18.1 or later.

Why it matters

CVE-2026-95843 is a high-severity vulnerability in Moquette MQTT broker that allows remote denial of service. Defenders should verify and upgrade to Moquette version 0.18.1 or later, review MQTT broker configurations, and monitor for similar attempts.

• Denial of service to client sessions on the affected MQTT broker
• Potential disruption to message handling and dependent services
• Need for verification of Moquette version and configuration
• Possible impact on MQTT broker performance and stability

Technical summary

CVE-2026-95843 is a vulnerability in the Moquette MQTT broker that allows a remote client to cause a denial of service by sending a malformed shared subscription filter. The issue arises from the PostOffice.subscribe method parsing a shared-subscription filter through SharedSubscriptionUtils.extractShareName before validating the complete $share/{shareName}/{topicFilter} structure. This can lead to a StringIndexOutOfBoundsException, terminating command handling on the shared session event loop and affecting other client sessions assigned to that loop. The vulnerability is fixed in Moquette version 0.18.1.

Defensive priority

Defenders should prioritize verifying and upgrading to Moquette version 0.18.1 or later.

Recommended defensive actions

• Verify Moquette version and upgrade to 0.18.1 or later if necessary
• Review and adjust MQTT broker configurations for secure shared subscription filters
• Monitor for similar denial of service attempts on the MQTT broker
• Perform vulnerability assessment for exposed Moquette deployments
• Inventory affected assets and prioritize remediation
• Implement compensating controls for exposed systems
• Track remediation progress and verify fixes

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, while GitHub references offer patch and release information. The vulnerability is fixed in Moquette version 0.18.1. Defenders should verify their Moquette versions and configurations. The issue allows remote denial of service via malformed shared subscription filters. Limited source detail is available; explicit evidence limits and defensive verification tasks are required.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.