CyberRota Analysis
AI-GeneratedMoquette, a lightweight Java MQTT broker, is vulnerable to a session collision issue in versions prior to 0.18.1, where a client's message map can conflict with another client's metadata map due to naming conventions. This vulnerability can lead to severe consequences, including message loss, misdelivery, and potential exposure of sensitive queued content. Organizations using affected versions of Moquette should prioritize upgrading to version 0.18.1 to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, H2PersistentQueue derives a session's message-map name as queue_ plus the client ID and its metadata-map name as queue_ plus the client ID plus _meta. A durable session whose client ID ends in _meta can therefore make its message map collide with another client's metadata map. The colliding sessions read and write the same H2 MVStore map with incompatible value types, which can corrupt queue head and tail data and cause message loss, misdelivery, failed queue reloads, or exposure of queued content across sessions. This issue is fixed in version 0.18.1.
Related CVEs
Other vulnerabilities affecting the same vendor(s)