Moquette versions before 0.18.1 contain an input validation flaw in the PostOffice.subscribe function. Specifically, the method parses a shared-subscription filter string using SharedSubscriptionUtils.extractShareName without fully validating the expected structure of $share/{shareName}/{topicFilter}. A remote attacker can send a malformed filter such as $share/grp, which lacks the topic-filter portion, triggering a StringIndexOutOfBoundsException. This exception terminates command handling on the shared session event loop, resulting in denial of service to other client sessions assigned to that loop. The vulnerability is fixed in version 0.18.1.

Exploitation of this vulnerability allows a remote unauthenticated client to cause a denial of service by crashing the shared session event loop handling MQTT subscriptions. This disrupts service for other clients sharing the same event loop, potentially impacting availability of the MQTT broker.

Upgrade moquette to version 0.18.1 or later, where this input validation issue is fixed. No other mitigations are indicated.