Moquette client IDs can cause cross-session H2 durable-queue corruption
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, H2PersistentQueue derives a session's message-map name as queue_ plus the client ID and its metadata-map name as queue_ plus the client ID plus _meta. A durable session whose client ID ends in _meta can therefore make its message map collide with another client's metadata map. The colliding sessions read and write the same H2 MVStore map with incompatible value types, which can corrupt queue head and tail data and cause message loss, misdelivery, failed queue reloads, or exposure of queued content across sessions. This issue is fixed in version 0.18.1.
describes (7)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-95848US | critical9.1OT elevated | — | ||
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured authenticator or authorizator class cannot be loaded, Server.initializeAuthenticator and Server.initi… | ||||
| CVE-2026-95846US | high7.5OT elevated | — | ||
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will message without applying the canWrite authorization and reserved-… | ||||
| CVE-2026-95845US | high7.5OT elevated | — | ||
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, the broker does not enforce a maximum length for pending per-session message queues. When a fast publisher sends messag… | ||||
| CVE-2026-95844US | high7.5OT elevated | — | ||
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, Moquette does not limit the depth of topic names and topic filters before processing them through recursive CTrie inser… | ||||
| CVE-2026-95843US | high7.5OT elevated | — | ||
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.subscribe parses a shared-subscription filter through SharedSubscriptionUtils.extractShareName before valida… | ||||
| CVE-2026-95842US | high7.5OT elevated | — | ||
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, SessionEventLoop.run catches only InterruptedException, and SessionEventLoopGroup does not restart a terminated loop. A… | ||||
| CVE-2026-85724US | —OT elevated | — | ||
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username… | ||||
references
External citations — patches, advisories, analysis.
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/95xxx/CVE-2026-95847.jsonADVISORY
- https://github.com/moquette-io/moquette/commit/72d6c8257191d2e4b2e3aa11ab25fd09f88c6cb7FIX
- https://github.com/moquette-io/moquette/pull/964FIX
- https://github.com/moquette-io/moquette/releases/tag/v0.18.1WEB
- https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhqADVISORY
- https://nvd.nist.gov/vuln/detail/CVE-2026-95847ADVISORY
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan