fix a vulnerability to malformed subscription requests