Moquette malformed shared subscriptions can crash command processing
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.subscribe parses a shared-subscription filter through SharedSubscriptionUtils.extractShareName before validating the complete $share/{shareName}/{topicFilter} structure. A remote client can send a filter such as $share/grp without a topic-filter portion, causing a StringIndexOutOfBoundsException while calculating the share name. The exception terminates command handling on the shared session event loop and can deny service to other client sessions assigned to that loop. This issue is fixed in version 0.18.1.
beschreibt (7)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-95848US | critical9.1OT erhöht | — | ||
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured authenticator or authorizator class cannot be loaded, Server.initializeAuthenticator and Server.initi… | ||||
| CVE-2026-95847US | high7.5OT erhöht | — | ||
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, H2PersistentQueue derives a session's message-map name as queue_ plus the client ID and its metadata-map name as queue_… | ||||
| CVE-2026-95846US | high7.5OT erhöht | — | ||
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will message without applying the canWrite authorization and reserved-… | ||||
| CVE-2026-95845US | high7.5OT erhöht | — | ||
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, the broker does not enforce a maximum length for pending per-session message queues. When a fast publisher sends messag… | ||||
| CVE-2026-95844US | high7.5OT erhöht | — | ||
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, Moquette does not limit the depth of topic names and topic filters before processing them through recursive CTrie inser… | ||||
| CVE-2026-95842US | high7.5OT erhöht | — | ||
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, SessionEventLoop.run catches only InterruptedException, and SessionEventLoopGroup does not restart a terminated loop. A… | ||||
| CVE-2026-85724US | —OT erhöht | — | ||
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/95xxx/CVE-2026-95843.jsonADVISORY
- https://github.com/moquette-io/moquette/commit/affdc71fdba92dc020421678970ae70518fb6da2FIX
- https://github.com/moquette-io/moquette/pull/962FIX
- https://github.com/moquette-io/moquette/releases/tag/v0.18.1WEB
- https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhqADVISORY
- https://nvd.nist.gov/vuln/detail/CVE-2026-95843ADVISORY
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan