CVE-2026-95847 Moquette client IDs can cause cross-session H2 durable-queue corruption

What is CVE-2026-95847?

CVE-2026-95847 is a high-severity vulnerability in moquette-io moquette, published on 23 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, H2PersistentQueue derives a session's message-map name as queue_ plus the client ID and its metadata-map name as queue_ plus the client ID plus _meta. A durable session whose client ID ends in _meta can therefore make its message map collide with another client's metadata map. The colliding sessions read and write the same H2 MVStore map with incompatible value types, which can corrupt queue head and tail data and cause message loss, misdelivery, failed queue reloads, or exposure of queued content across sessions. This issue is fixed in version 0.18.1.

Weakness: CWE-99

Which versions are affected by CVE-2026-95847?

It affects 1 product.

Products include Moquette Moquette.

How do I fix CVE-2026-95847?

No fix has been published for CVE-2026-95847 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-95847 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-95847 exists.

Other vulnerabilities in moquette-io moquette

• CVE-2026-85724 Moquette pattern ACL wildcard injection allows cross-tenant authorization bypass Critical 9.6
• CVE-2026-95848 Moquette fails open when configured authentication or authorization classes cannot load Critical 9.3
• CVE-2026-95842 Moquette uncaught MQTT command exceptions can terminate shared session event loops High 8.7
• CVE-2026-95843 Moquette malformed shared subscriptions can crash command processing High 8.7
• CVE-2026-95844 Moquette deeply nested MQTT topics can cause stack exhaustion High 8.7

Sources

• CVE record
• NVD
• OSV
• How this page is made