A high-severity resource injection vulnerability in the Moquette MQTT broker allows unauthenticated attackers to cause data corruption and unauthorized message exposure.

The vulnerability stems from improper control of resource identifiers within the H2PersistentQueue component. By crafting a client ID that ends in _meta, an unauthenticated attacker can force a collision between a session message map and a metadata map, leading to data corruption and potential message misdelivery or exposure.

Successful exploitation of this flaw can result in severe data integrity issues and the unauthorized exposure of sensitive MQTT messages across client sessions. Given the CVSS score of 8.8, this vulnerability poses a significant risk to the confidentiality and integrity of communications handled by the broker, potentially leading to operational disruption or the compromise of sensitive data streams in production environments.

Immediate Action: Update the Moquette broker to version 0.18.1 or later to resolve the resource naming collision issue.

Proactive Monitoring: Monitor server logs for unusual client ID patterns or frequent session reloads that may indicate attempts to trigger map collisions.

Compensating Controls: If immediate patching is not feasible, restrict access to the MQTT broker to trusted clients via network-level firewalls or mutual TLS authentication to limit the ability of unauthorized parties to connect and inject malicious client IDs.

Public Exploit Available: Unknown.

The severity of this vulnerability, combined with the potential for cross-session data corruption, necessitates prompt action. Administrators should prioritize upgrading to version 0.18.1 to eliminate the underlying logic error. Failure to update the software leaves the messaging infrastructure susceptible to exploitation that could compromise the integrity of all processed data.