Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-95847 Details

Description

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, H2PersistentQueue derives a session's message-map name as queue_ plus the client ID and its metadata-map name as queue_ plus the client ID plus _meta. A durable session whose client ID ends in _meta can therefore make its message map collide with another client's metadata map. The colliding sessions read and write the same H2 MVStore map with incompatible value types, which can corrupt queue head and tail data and cause message loss, misdelivery, failed queue reloads, or exposure of queued content across sessions. This issue is fixed in version 0.18.1.

Metrics

CVSS 3.x Severity and Vector Strings:

No CVSS 3.x data is available for this CVE.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq	CISA-ADP
https://github.com/moquette-io/moquette/commit/72d6c8257191d2e4b2e3aa11ab25fd09f88c6cb7	[email protected]
https://github.com/moquette-io/moquette/pull/964	[email protected]
https://github.com/moquette-io/moquette/releases/tag/v0.18.1	[email protected]
https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq	[email protected]

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-99	Improper Control of Resource Identifiers ('Resource Injection')	[email protected]

Affected Products

No affected product data is available for this CVE.

Change History

2 change records found show changes

Date	Action	Recorded By
Sep 23, 2026	New CVE Received	[email protected]
Sep 23, 2026	CVE Modified	CISA-ADP