Message Map Collision in Moquette MQTT Broker Affects Data Integrity

CVE-2026-95847

What is CVE-2026-95847?

The Moquette MQTT broker, prior to version 0.18.1, has a flaw in the H2PersistentQueue that governs message mapping for clients. If a durable session has a client ID that ends in '_meta', it can create a conflicting situation where its message map and another client's metadata map become intertwined. This collision leads to instances where the same H2 MVStore map is accessed by different sessions with incompatible data types, resulting in potential data corruption, loss of messages, misdelivery instances, failed reloads of the queue, and the unintended exposure of queued content across sessions. This issue is addressed in version 0.18.1.

References