Live › vulnerability › CVE-2026-115417
Go to dashboardaws-c-mqtt, the C MQTT library in the AWS Common Runtime, has a memory allocation with an excessive size value in its MQTT 3.1.1 compatibility adapter. A remote actor can cause a denial of service of the client process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that use aws-c-mqtt between 0.9.1 and 0.16.2, directly or through the AWS IoT Device SDK for C++ v2 or the AWS Common Runtime, are exposed. The flaw sits in the MQTT 3.1.1 compatibility adapter, so clients that only use a native MQTT5 path are less exposed. Teams running only fixed versions or unrelated MQTT stacks can skip it.
No product ranges from the sources yet.
>= 0.9.1 and < 0.16.2 are affected.v0.16.2 or later.The fix above is the answer. These hold the line until you can deploy it, and are the only option on lines that get no fix.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-115417 - Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt
Bulletin ID: 2026-147-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/22/2026 13:30 PM PDT
Description:
aws-c-mqtt is a C99 implementation of the MQTT 3.1.1 and MQTT5 specifications, distributed as part of the AWS Common Runtime (CRT) and bundled in the AWS IoT Device SDK for C++ v2. We identified CVE-2026-115417, a memory allocation with excessive size value (CWE-789) in the library's MQTT 3.1.1 compatibility adapter. Under certain conditions, a remote actor could cause a denial of service of the client process.
Impacted versions: >= 0.9.1 AND < 0.16.2
Resolution:
This issue has been addressed in aws-c-mqtt version v0.16.2. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds:
Connect only to trusted MQTT brokers (for example AWS IoT Core, which enforces the negotiated maximum packet size) and use TLS to prevent on-path tampering of broker responses. Where feasible, avoid the MQTT 3.1.1 compatibility adapter in favor of a native MQTT5 or MQTT 3.1.1 client. Upgrading to a fixed version is the complete remediation.
References:
Acknowledgement:
We would like to thank Eunho Kim for collaborating on this issue through the coordinated vulnerability disclosure process.
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("CVE-2026-115417")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.