CVE-2026-95847
Received Received - Intake

MQTT Session Data Corruption in Moquette Broker

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, H2PersistentQueue derives a session's message-map name as queue_ plus the client ID and its metadata-map name as queue_ plus the client ID plus _meta. A durable session whose client ID ends in _meta can therefore make its message map collide with another client's metadata map. The colliding sessions read and write the same H2 MVStore map with incompatible value types, which can corrupt queue head and tail data and cause message loss, misdelivery, failed queue reloads, or exposure of queued content across sessions. This issue is fixed in version 0.18.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-95847
EUVD
EUVD-2026-85417

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
moquette moquette 0.18.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-99 The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Moquette MQTT broker versions before 0.18.1. It involves a client-ID collision where a session's message map and metadata map share a naming scheme using the client ID. If a client ID ends with '_meta', it can collide with another client's metadata map, causing both sessions to access the same H2 database map with incompatible data types. This leads to corruption of queue head and tail data, resulting in message loss, misdelivery, failed queue reloads, or exposure of queued content across sessions.

Detection Guidance

Check Moquette broker logs for queue corruption errors or failed reloads. Inspect client IDs ending in '_meta' which may indicate collision attempts. Verify H2 database files for inconsistent queue head/tail pointers or mismatched data types in message and metadata maps.

Impact Analysis

If you use Moquette MQTT broker versions before 0.18.1, an attacker could exploit this vulnerability by using a crafted client ID to corrupt durable message queues. This could result in message loss, messages being delivered to wrong recipients, queues failing to reload after restarts, or unauthorized access to queued messages across different sessions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, such as messages containing personal or health information, violating GDPR and HIPAA compliance. Message loss or misdelivery may also result in non-compliance with data integrity and confidentiality requirements.

Mitigation Strategies

Upgrade Moquette to version 0.18.1 or later. Monitor for queue corruption symptoms like message loss or misdelivery. If using durable queues, ensure no client IDs end in '_meta' to prevent collisions during migration.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-95847. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart