Moquette implements durable queues by naming the H2 MVStore maps based on the client ID. Because a client ID that ends with the suffix '_meta' is used for the metadata map, a durable session can unintentionally use the same map name for its message queue. This accidental collision causes the broker to read and write the same underlying map with incompatible value types, corrupting queue head and tail metadata. As a result, clients may lose messages, receive messages out of order, see queued data that belongs to another session, or face failed queue reloads.

The issue affects the Moquette broker version prior to 0.18.1. Applications running Moquette 0.18.0 or earlier are vulnerable when they accept client IDs that end with the suffix '_meta'.

With a CVSS score of 8.8 the vulnerability is considered high severity. No EPSS score is available, so the current exploitation probability is uncertain, and the vulnerability is not listed in the CISA KEV catalog. An attacker who can control the client ID of a durable connection can trigger the collision by using a value ending in '_meta'; the attack vector is therefore a remote client connection over the MQTT protocol.