Moquette is a lightweight Java MQTT broker. A malformed shared‑subscription filter such as "$share/grp" that omits the topic‑filter portion causes a StringIndexOutOfBoundsException during parsing. The exception terminates command handling on the shared session event loop and can deny service to other client sessions that share that loop. This is a classic input validation flaw (CWE‑20).

The vulnerability affects the Moquette broker released by moquette‑io, specifically any version prior to 0.18.1. Users running versions below 0.18.1 are exposed to the issue.

The CVSS score of 8.7 indicates high severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a remote client that can send arbitrary subscription requests over the MQTT protocol; the description does not explicitly state it, so we infer a network‑based attack. Once exploited, the crash can disrupt service for other clients on the same event loop, potentially affecting availability for a segment of the system.