A critical denial of service vulnerability in the Moquette MQTT broker allows unauthenticated remote attackers to disrupt service for multiple clients by sending malformed subscription filters.

The vulnerability is caused by improper input validation within the PostOffice.subscribe function. An unauthenticated remote attacker can supply a specifically crafted shared subscription filter that lacks a required topic-filter portion, triggering a StringIndexOutOfBoundsException that crashes the shared session event loop.

The successful exploitation of this vulnerability results in a denial of service for all client sessions associated with the affected event loop, directly impacting system availability and messaging reliability. With a CVSS score of 8.7, this represents a high-severity risk that could lead to significant operational disruption in environments relying on the Moquette broker for critical communication.

Immediate Action: Update the Moquette broker to version 0.18.1 or later immediately to incorporate the necessary input validation fix.

Proactive Monitoring: Monitor broker logs for repeated StringIndexOutOfBoundsException errors or sudden, unexplained drops in connected MQTT client sessions.

Compensating Controls: Deploy a network-level filter or Web Application Firewall that can inspect MQTT traffic for malformed $share subscription patterns until the patch is deployed.

Public Exploit Available: Unknown

Given the ease with which an unauthenticated attacker can disrupt service, organizations should prioritize upgrading to version 0.18.1. The potential for widespread service interruption across shared session loops makes this a high-priority task for all IT administrators managing Moquette deployments.