Vulnerability in Moquette
CVE-2026-95847
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, H2PersistentQueue derives a session's message-map name as queue_ plus the client ID and its metadata-map name as queue_ plus the client ID plus _meta. A durable session whose client ID ends in _meta can therefore make its message map collide with another client's metadata map. The colliding sessions read and write the same H2 MVStore map with incompatible value types, which can corrupt queue head and tail data and cause message loss, misdelivery, failed queue reloads, or exposure of queued content across sessions. This issue is fixed in version 0.18.1.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.
EPSS exploit prediction
EPSS: 0.003 (27.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 28th percentile — 27.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- Moquette
- Moquette-Io Moquette — versions < 0.18.1
Weakness classification (CWE)
References
- github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq (Exploit, Mitigation, Vendor Advisory)
- github.com/moquette-io/moquette/pull/964 (Patch)
- github.com/moquette-io/moquette/commit/72d6c8257191d2e4b2e3aa11ab25fd09f88c6cb7 (Patch)
- github.com/moquette-io/moquette/releases/tag/v0.18.1 (Release Notes)
Frequently asked questions
- What is CVE-2026-95847?
- CVE-2026-95847 is a high-severity vulnerability in Moquette, classified under Resource Injection. CVSS score: 7.5/10. Published 2026-09-23.
- How severe is CVE-2026-95847?
- High severity. CVSS v3 base score is 7.5 out of 10.