CVE-2026-95847: CWE-99: Improper Control of Resource Identifiers ('Resource Injection') in moquette-io moquette
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, H2PersistentQueue derives a session's message-map name as queue_ plus the client ID and its metadata-map name as queue_ plus the client ID plus _meta. A durable session whose client ID ends in _meta can therefore make its message map collide with another client's metadata map. The colliding sessions read and write the same H2 MVStore map with incompatible value types, which can corrupt queue head and tail data and cause message loss, misdelivery, failed queue reloads, or exposure of queued content across sessions. This issue is fixed in version 0.18.1.
AI Analysis
Technical Summary
Moquette versions before 0.18.1 have a resource injection vulnerability (CWE-99) due to how H2PersistentQueue constructs session message and metadata map names. Specifically, a durable session with a client ID ending in '_meta' causes its message map name to collide with another client's metadata map name. This results in both sessions accessing the same H2 MVStore map with incompatible value types, which can corrupt queue head and tail data. The corruption can cause message loss, misdelivery, failed queue reloads, or exposure of queued content across sessions. The issue is resolved in moquette version 0.18.1.
Potential Impact
The vulnerability can lead to corruption of message queues, causing message loss, misdelivery, and failed queue reloads. Additionally, it may expose queued content across different sessions, potentially violating confidentiality. The CVSS 4.0 base score is 8.8 (high severity), reflecting network attack vector, no privileges required, no user interaction, and high impact on integrity.
Mitigation Recommendations
Upgrade moquette to version 0.18.1 or later, where this vulnerability is fixed. No other mitigation is indicated or required according to the available data.
CVE-2026-95847: CWE-99: Improper Control of Resource Identifiers ('Resource Injection') in moquette-io moquette
Description
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, H2PersistentQueue derives a session's message-map name as queue_ plus the client ID and its metadata-map name as queue_ plus the client ID plus _meta. A durable session whose client ID ends in _meta can therefore make its message map collide with another client's metadata map. The colliding sessions read and write the same H2 MVStore map with incompatible value types, which can corrupt queue head and tail data and cause message loss, misdelivery, failed queue reloads, or exposure of queued content across sessions. This issue is fixed in version 0.18.1.
CVSS v4.0
Score 8.8high
Affected software
moquette-io
moquette
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Moquette versions before 0.18.1 have a resource injection vulnerability (CWE-99) due to how H2PersistentQueue constructs session message and metadata map names. Specifically, a durable session with a client ID ending in '_meta' causes its message map name to collide with another client's metadata map name. This results in both sessions accessing the same H2 MVStore map with incompatible value types, which can corrupt queue head and tail data. The corruption can cause message loss, misdelivery, failed queue reloads, or exposure of queued content across sessions. The issue is resolved in moquette version 0.18.1.
Potential Impact
The vulnerability can lead to corruption of message queues, causing message loss, misdelivery, and failed queue reloads. Additionally, it may expose queued content across different sessions, potentially violating confidentiality. The CVSS 4.0 base score is 8.8 (high severity), reflecting network attack vector, no privileges required, no user interaction, and high impact on integrity.
Mitigation Recommendations
Upgrade moquette to version 0.18.1 or later, where this vulnerability is fixed. No other mitigation is indicated or required according to the available data.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-09-22T16:39:45.794Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ab402daf7a7c541060ee0d5
Added to database: 09/23/2026, 16:48:26 UTC
Last enriched: 09/23/2026, 17:03:29 UTC
Last updated: 09/24/2026, 01:57:04 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.