CVE-2026-95843

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-95843
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-95843.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-95843
Aliases
Published
2026-09-23T16:29:44Z
Modified
2026-10-22T16:38:01Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Moquette malformed shared subscriptions can crash command processing
Details

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.subscribe parses a shared-subscription filter through SharedSubscriptionUtils.extractShareName before validating the complete $share/{shareName}/{topicFilter} structure. A remote client can send a filter such as $share/grp without a topic-filter portion, causing a StringIndexOutOfBoundsException while calculating the share name. The exception terminates command handling on the shared session event loop and can deny service to other client sessions assigned to that loop. This issue is fixed in version 0.18.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-20"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/95xxx/CVE-2026-95843.json"
}
References

Affected packages

Git / github.com/moquette-io/moquette

Affected ranges

Type
GIT
Repo
https://github.com/moquette-io/moquette
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e8ce83336acce69d8e9c11c98805217aa156a16b
Fixed
affdc71fdba92dc020421678970ae70518fb6da2
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:moquette:moquette:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "0.18.1"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "range": [
                {
                    "fixed": "affdc71fdba92dc020421678970ae70518fb6da2"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v0.18.1",
            "range": [
                {
                    "fixed": "e8ce83336acce69d8e9c11c98805217aa156a16b"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

0.*
0.18.0
0.7
Other
before_sofia2
last_gradle
last_osgi
last_with_maven
last_with_ringbuffer
second_try_with_osgi_giveup
v0.*
v0.10
v0.11
v0.12
v0.12.1
v0.18.0
v0.8
v0.9

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-95843.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "260478471734483761549100715465886470868",
                "60415648911726053262337263363581505916",
                "212963164542809097223158470117432098792",
                "66930572998699971319340826652824315649",
                "95833119695761673601431083465406292404",
                "174457557961167344406769577226070698984"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-95843-38db9523",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/moquette-io/moquette/commit/affdc71fdba92dc020421678970ae70518fb6da2",
        "target": {
            "file": "broker/src/test/java/io/moquette/broker/SessionEventLoopTest.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "134349480296543909299472719321097315443",
            "length": 2405
        },
        "id": "CVE-2026-95843-5a133aeb",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/moquette-io/moquette/commit/affdc71fdba92dc020421678970ae70518fb6da2",
        "target": {
            "file": "broker/src/main/java/io/moquette/broker/PostOffice.java",
            "function": "subscribeClientToTopics"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "125934402496039774032489400899577824671",
                "97613260811307606878787548982365940575",
                "194124313706569377730830380205618863064",
                "98759703094230735429873617428752823834",
                "151667620550621537510635487564784526737",
                "298665657250269000325539426819647196805",
                "6961804197908287411135667264258188116",
                "115702242087409162551442075226758708597",
                "73239519799422741324174551015351375855",
                "111626495142943806698198271900118451859",
                "106722594160222890831110186940622336431",
                "242235614090897640158795429959330186798",
                "136376459619982409254979200638312985417",
                "328326150562565909947507184007524171995",
                "175960658397598025555836414328727520262"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-95843-67f4fadd",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/moquette-io/moquette/commit/affdc71fdba92dc020421678970ae70518fb6da2",
        "target": {
            "file": "broker/src/main/java/io/moquette/broker/PostOffice.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "146408937695327925013946960741496245001",
                "35240469452939156180892302589480994893"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-95843-ab438d47",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/moquette-io/moquette/commit/affdc71fdba92dc020421678970ae70518fb6da2",
        "target": {
            "file": "broker/src/main/java/io/moquette/broker/SharedSubscriptionUtils.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "264460424198365981025294149882277014898",
                "11410191927348774178838709852851310256",
                "273802157253247414129958982189405529275",
                "315296026132642631038163665576809441438"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-95843-dd85d397",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/moquette-io/moquette/commit/e8ce83336acce69d8e9c11c98805217aa156a16b",
        "target": {
            "file": "broker/src/main/java/io/moquette/broker/Server.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "79921775663416493771587660209009728913",
            "length": 744
        },
        "id": "CVE-2026-95843-f22c9bdd",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/moquette-io/moquette/commit/affdc71fdba92dc020421678970ae70518fb6da2",
        "target": {
            "file": "broker/src/test/java/io/moquette/broker/SessionEventLoopTest.java",
            "function": "givenACommandThatThrowsWhenProcessedThenTheSharedSessionLoopKeepsRunning"
        }
    }
]
vanir_signatures_modified 
"2026-10-22T16:38:01Z"