What’s Vulnerable › Vulnerabilities

CVE-2026-95847: Moquette client IDs can cause cross-session H2 durable-queue corruption

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-09-23 · updated 2026-09-28
• Weakness: CWE-99

Description

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, H2PersistentQueue derives a session's message-map name as queue_ plus the client ID and its metadata-map name as queue_ plus the client ID plus _meta. A durable session whose client ID ends in _meta can therefore make its message map collide with another client's metadata map. The colliding sessions read and write the same H2 MVStore map with incompatible value types, which can corrupt queue head and tail data and cause message loss, misdelivery, failed queue reloads, or exposure of queued content across sessions. This issue is fixed in version 0.18.1.

Affected products

• moquette-io moquette: before 0.18.1 — fixed in 0.18.1

How to fix

Upgrade to a fixed version: moquette-io moquette 0.18.1. Check the vendor advisory for mitigations.

References

• https://github.com/moquette-io/moquette/commit/72d6c8257191d2e4b2e3aa11ab25fd09f88c6cb7
• https://github.com/moquette-io/moquette/pull/964
• https://github.com/moquette-io/moquette/releases/tag/v0.18.1
• https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq
• https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq

Get alerted when CVE-2026-95847 or the next vulnerability affects your stack