{"id":"CVE-2026-115417","kind":"vulnerability","aliases":["CVE-2026-115417"],"related":[],"title":"AWS aws-c-mqtt: oversized allocation in MQTT 3.1.1 adapter lets remote peer crash client","description":"CVE-2026-115417 - Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt\n\n### CVE-2026-115417 - Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt\n\nBulletin ID: 2026-147-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/22/2026 13:30 PM PDT\n\nDescription:\n\naws-c-mqtt is a C99 implementation of the MQTT 3.1.1 and MQTT5 specifications, distributed as part of the AWS Common Runtime (CRT) and bundled in the AWS IoT Device SDK for C++ v2. We identified CVE-2026-115417, a memory allocation with excessive size value (CWE-789) in the library's MQTT 3.1.1 compatibility adapter. Under certain conditions, a remote actor could cause a denial of service of the client process.\n\nImpacted versions: >= 0.9.1 AND < 0.16.2\n\nResolution:\n\nThis issue has been addressed in aws-c-mqtt version v0.16.2. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nConnect only to trusted MQTT brokers (for example AWS IoT Core, which enforces the negotiated maximum packet size) and use TLS to prevent on-path tampering of broker responses. Where feasible, avoid the MQTT 3.1.1 compatibility adapter in favor of a native MQTT5 or MQTT 3.1.1 client. Upgrading to a fixed version is the complete remediation.\n\nReferences:\n\n- CVE-2026-115417\n- GHSA-g3x5-86mr-65p5\n\nAcknowledgement:\n\nWe would like to thank Eunho Kim for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"aws-c-mqtt, the C MQTT library in the AWS Common Runtime, has a memory allocation with an excessive size value in its MQTT 3.1.1 compatibility adapter. A remote actor can cause a denial of service of the client process.","severity":"high","cvss":8.2,"epss":0.0035,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aws","aws-c-mqtt","aws-iot","c","iot-devices","lab-disclosure","mqtt","package"],"not_affected_if":["fixed-version","native-mqtt5-only"],"how_to_check":"- Check the aws-c-mqtt version in your build (for example the vendored copy or the lockfile); versions `>= 0.9.1` and `< 0.16.2` are affected.\n- Check whether the AWS IoT Device SDK for C++ v2 is bundled, since it ships aws-c-mqtt.\n- Check whether the application uses the MQTT 3.1.1 compatibility adapter rather than a native MQTT5 or MQTT 3.1.1 client path.","fix":"- Upgrade aws-c-mqtt to `v0.16.2` or later.\n- Upgrade the AWS IoT Device SDK for C++ v2 build that bundles it, and patch any forked or derivative copies.\n- Until upgraded, connect only to trusted brokers such as AWS IoT Core and use TLS.","status":"open","published_at":"2026-10-22T00:00:00+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T03:03:47+00:00","updated_at":"2026-10-25T03:03:47+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:03:47Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade aws-c-mqtt to `v0.16.2` or later.\n- Upgrade the AWS IoT Device SDK for C++ v2 build that bundles it, and patch any forked or derivative copies.\n- Until upgraded, connect only to trusted brokers such as AWS IoT Core and use TLS.","reach":"network","title":"AWS aws-c-mqtt: oversized allocation in MQTT 3.1.1 adapter lets remote peer crash client","impact":"low","summary":"aws-c-mqtt, the C MQTT library in the AWS Common Runtime, has a memory allocation with an excessive size value in its MQTT 3.1.1 compatibility adapter. A remote actor can cause a denial of service of the client process.","category":"package","nicknames":[],"who_cares":["aws-iot","aws-c-mqtt","c","iot-devices","mqtt"],"confidence":0.6,"needs_auth":"unknown","worst_case":"remote peer crashes the client process through denial of service","analyst_note":"Sources do not say what exact condition triggers the oversized allocation or whether a malicious broker is required; check the GHSA-g3x5-86mr-65p5 advisory for trigger details.","how_to_check":"- Check the aws-c-mqtt version in your build (for example the vendored copy or the lockfile); versions `>= 0.9.1` and `< 0.16.2` are affected.\n- Check whether the AWS IoT Device SDK for C++ v2 is bundled, since it ships aws-c-mqtt.\n- Check whether the application uses the MQTT 3.1.1 compatibility adapter rather than a native MQTT5 or MQTT 3.1.1 client path.","needs_analyst":true,"not_affected_if":["fixed-version","native-mqtt5-only"],"who_is_affected":"Applications that use aws-c-mqtt between 0.9.1 and 0.16.2, directly or through the AWS IoT Device SDK for C++ v2 or the AWS Common Runtime, are exposed. The flaw sits in the MQTT 3.1.1 compatibility adapter, so clients that only use a native MQTT5 path are less exposed. Teams running only fixed versions or unrelated MQTT stacks can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000816,"input_tokens":4069,"output_tokens":818,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-115417':19A,22A,83C,103C,180C,314C '-147':124C '-2026':18A,21A,82C,102C,179C,313C '-789':189C '0.16.2':218C '0.9.1':216C '10/22/2026':135C '13':136C '2026':123C '3.1.1':10A,65B,93C,113C,152C,195C,289C,300C '30':137C '65p5':319C '86mr':318C 'acknowledg':320C 'actor':70B,203C 'adapt':11A,67B,95C,115C,197C,291C 'address':224C 'alloc':7A,56B,85C,105C,183C 'attent':132C 'avoid':286C 'aw':1A,3A,23B,25B,29B,41B,50B,98C,118C,125C,127C,142C,161C,169C,227C,262C 'aws-c-mqtt':2A,24B,40B,97C,117C,141C,226C 'aws-iot':28B 'aws-security@amazon.com':341C 'broker':259C,282C 'bulletin':121C 'bundl':166C 'c':4A,26B,31B,42B,45B,99C,119C,143C,174C,228C 'c99':147C 'caus':72B,205C 'certain':199C 'client':16A,79B,212C,301C 'code':245C 'collabor':329C 'common':51B,162C 'compat':66B,94C,114C,196C,290C 'complet':309C 'concern':347C 'condit':200C 'connect':254C 'content':128C 'coordin':335C 'core':264C 'could':204C 'crash':15A 'crt':164C 'cve':17A,20A,81C,101C,178C,312C 'cwe':188C 'date':134C 'denial':74B,207C 'deriv':244C 'descript':140C 'devic':34B,171C 'disclosur':37B,337C 'distribut':156C 'email':340C 'enforc':266C 'ensur':240C 'eunho':326C 'exampl':261C 'excess':59B,87C,107C,185C 'favor':293C 'feasibl':285C 'fix':252C,305C 'fork':242C 'g3x5':317C 'ghsa':316C 'ghsa-g3x5-86mr-65p5':315C 'id':122C 'identifi':177C 'impact':214C 'implement':148C 'import':130C 'incorpor':249C 'iot':30B,33B,170C,263C 'iot-devic':32B 'issu':221C,332C 'kim':327C 'lab':36B 'lab-disclosur':35B 'latest':237C 'let':12A 'librari':47B,192C 'like':323C 'maximum':269C 'memori':55B,84C,104C,182C 'mqtt':5A,9A,27B,38B,43B,46B,64B,92C,100C,112C,120C,144C,151C,194C,229C,258C,288C,299C 'mqtt5':154C,297C 'nativ':296C 'negoti':268C 'new':251C 'on-path':277C 'overs':6A 'packag':39B 'packet':270C 'part':158C 'patch':247C 'path':279C 'pdt':139C 'peer':14A 'pleas':339C 'pm':138C 'prevent':276C 'process':80B,213C,338C 'public':133C 'question':345C 'recommend':233C 'refer':311C 'remedi':310C 'remot':13A,69B,202C 'requir':131C 'resolut':219C 'respons':283C 'runtim':52B,163C 'scope':126C 'sdk':172C 'secur':344C 'servic':76B,209C 'size':60B,88C,108C,186C,271C 'specif':155C 'tamper':280C 'thank':325C 'tls':274C 'trust':257C 'type':129C 'upgrad':234C,302C 'use':273C 'v0.16.2':231C 'v2':175C 'valu':61B,89C,109C,187C 'version':215C,230C,238C,306C 'vulner':336C 'workaround':253C 'would':322C","nicknames":[],"mitigations":[{"kind":"workaround","scope":"aws-c-mqtt MQTT 3.1.1 compatibility adapter","since":null,"covers":"Client code no longer uses the MQTT 3.1.1 compatibility adapter, so the vulnerable code path is not exercised","limits":"none stated","source":"https://aws.amazon.com/security/security-bulletins/rss/2026-147-aws/","vendor":"Team","seen_at":"2026-10-24T20:05:26Z","confidence":0.6,"source_title":"CVE-2026-115417 - Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt","customer_action":"Switch to a native MQTT5 or MQTT 3.1.1 client where feasible, instead of the MQTT 3.1.1 compatibility adapter"}],"who_affected":"Applications that use aws-c-mqtt between 0.9.1 and 0.16.2, directly or through the AWS IoT Device SDK for C++ v2 or the AWS Common Runtime, are exposed. The flaw sits in the MQTT 3.1.1 compatibility adapter, so clients that only use a native MQTT5 path are less exposed. Teams running only fixed versions or unrelated MQTT stacks can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T00:00:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ff89ba41-3aa1-4d27-914a-91399e9639e5","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115417","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115417","severity":null,"published_at":"2026-10-22T21:17:17+00:00","modified_at":"2026-10-23T17:17:17+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115417","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115417","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null},{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-147-aws/#CVE-2026-115417","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-147-aws/","severity":null,"published_at":"2026-10-22T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-24T20:05:36+00:00","fetched_at":"2026-10-24T20:05:36+00:00","note":"AWS: CVE-2026-115417 - Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt"}],"documents":[{"id":2975,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-147-aws/","title":"AWS: CVE-2026-115417 - Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt","kind":"advisory","source":"lab","text":"CVE-2026-115417 - Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt\n\n### CVE-2026-115417 - Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt\n\nBulletin ID: 2026-147-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/22/2026 13:30 PM PDT\n\nDescription:\n\naws-c-mqtt is a C99 implementation of the MQTT 3.1.1 and MQTT5 specifications, distributed as part of the AWS Common Runtime (CRT) and bundled in the AWS IoT Device SDK for C++ v2. We identified CVE-2026-115417, a memory allocation with excessive size value (CWE-789) in the library's MQTT 3.1.1 compatibility adapter. Under certain conditions, a remote actor could cause a denial of service of the client process.\n\nImpacted versions: >= 0.9.1 AND < 0.16.2\n\nResolution:\n\nThis issue has been addressed in aws-c-mqtt version v0.16.2. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nConnect only to trusted MQTT brokers (for example AWS IoT Core, which enforces the negotiated maximum packet size) and use TLS to prevent on-path tampering of broker responses. Where feasible, avoid the MQTT 3.1.1 compatibility adapter in favor of a native MQTT5 or MQTT 3.1.1 client. Upgrading to a fixed version is the complete remediation.\n\nReferences:\n\n- CVE-2026-115417\n- GHSA-g3x5-86mr-65p5\n\nAcknowledgement:\n\nWe would like to thank Eunho Kim for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":"2026-10-22T00:00:00+00:00","relation":"advisory","confidence":null,"note":"AWS disclosure page"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}