CVE-2026-95847: Moquette client IDs can cause cross-session H2 durable-queue corruption
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, H2PersistentQueue derives a session's message-map name as queue plus the client ID and its metadata-map name as queue plus the client ID plus meta. A durable session whose client ID ends in meta can therefore make its message map collide with another client's metadata map. The colliding sessions read and write the same H2 MVStore map with incompatible value types, which can corrupt queue head and tail data and cause message loss, misdelivery, failed queue reloads, or exposure of queued content across sessions. This issue is fixed in version 0.18.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Moquetteto a version that resolves this vulnerability.Fixed in 0.18.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Moquette deployments using H2PersistentQueue with durable sessions are exposed prior to version 0.18.1. The collision requires client IDs whose names create an overlap between one session's message-map name and another session's metadata-map name.
What must an attacker be able to do to trigger the collision?
An attacker needs to establish or control durable MQTT sessions with chosen client IDs. In particular, a client ID ending in _meta can collide with the metadata map associated with another client ID.
What is the impact if a collision occurs?
The two sessions can read and write the same H2 MVStore map using incompatible value types. This can corrupt queue head and tail data, causing message loss, misdelivery, queue reload failures, or exposure of queued content between sessions.
What should operators do if they cannot immediately upgrade?
Restrict durable-session client IDs so that IDs ending in _meta cannot be used and prevent clients from choosing conflicting IDs. Upgrade to Moquette 0.18.1 when possible, as that version fixes the issue.