{"id":"GHSA-g3x5-86mr-65p5","kind":"vulnerability","aliases":["GHSA-g3x5-86mr-65p5"],"related":[],"title":"CVE-2026-115417 - Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt","description":"CVE-2026-115417 - Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt\n\n### CVE-2026-115417 - Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt\n\nBulletin ID: 2026-147-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/22/2026 13:30 PM PDT\n\nDescription:\n\naws-c-mqtt is a C99 implementation of the MQTT 3.1.1 and MQTT5 specifications, distributed as part of the AWS Common Runtime (CRT) and bundled in the AWS IoT Device SDK for C++ v2. We identified CVE-2026-115417, a memory allocation with excessive size value (CWE-789) in the library's MQTT 3.1.1 compatibility adapter. Under certain conditions, a remote actor could cause a denial of service of the client process.\n\nImpacted versions: >= 0.9.1 AND < 0.16.2\n\nResolution:\n\nThis issue has been addressed in aws-c-mqtt version v0.16.2. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nConnect only to trusted MQTT brokers (for example AWS IoT Core, which enforces the negotiated maximum packet size) and use TLS to prevent on-path tampering of broker responses. Where feasible, avoid the MQTT 3.1.1 compatibility adapter in favor of a native MQTT5 or MQTT 3.1.1 client. Upgrading to a fixed version is the complete remediation.\n\nReferences:\n\n- CVE-2026-115417\n- GHSA-g3x5-86mr-65p5\n\nAcknowledgement:\n\nWe would like to thank Eunho Kim for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"The MQTT 3.1.1 compatibility adapter in aws-c-mqtt, the C library in the AWS Common Runtime and AWS IoT Device SDK for C++ v2, allocates memory using an excessive size value (CWE-789). A remote actor can exploit this to cause a denial of service of the client process.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aws","c++","embedded","iot","lab-disclosure","mqtt","package"],"not_affected_if":["no-mqtt-3.1.1-adapter","version-fixed"],"how_to_check":"- Check the aws-c-mqtt version in your build or lockfile; affected versions are `>= 0.9.1` and `< 0.16.2`.\n- Check whether the AWS IoT Device SDK for C++ v2 is bundled in your application, since it ships aws-c-mqtt.\n- Check whether your code uses the MQTT 3.1.1 compatibility adapter rather than a native MQTT5 client.","fix":"- Upgrade aws-c-mqtt to `v0.16.2` or later.\n- Rebuild and redeploy applications that bundle the AWS IoT Device SDK for C++ v2 or any forked copy of aws-c-mqtt.\n- Until upgraded, connect only to trusted MQTT brokers such as AWS IoT Core and use TLS.","status":"open","published_at":"2026-10-22T00:00:00+00:00","first_seen_at":"2026-10-24T20:05:36+00:00","triaged_at":"2026-10-25T05:00:39+00:00","updated_at":"2026-10-25T05:00:39+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T05:00:39Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade aws-c-mqtt to `v0.16.2` or later.\n- Rebuild and redeploy applications that bundle the AWS IoT Device SDK for C++ v2 or any forked copy of aws-c-mqtt.\n- Until upgraded, connect only to trusted MQTT brokers such as AWS IoT Core and use TLS.","reach":"network","title":"aws-c-mqtt: excessive allocation size lets a remote broker crash clients","impact":"low","summary":"The MQTT 3.1.1 compatibility adapter in aws-c-mqtt, the C library in the AWS Common Runtime and AWS IoT Device SDK for C++ v2, allocates memory using an excessive size value (CWE-789). A remote actor can exploit this to cause a denial of service of the client process.","category":"package","nicknames":[],"who_cares":["aws","iot","c++","embedded","mqtt"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Remote actor crashes the client process through excessive memory allocation","analyst_note":"","how_to_check":"- Check the aws-c-mqtt version in your build or lockfile; affected versions are `>= 0.9.1` and `< 0.16.2`.\n- Check whether the AWS IoT Device SDK for C++ v2 is bundled in your application, since it ships aws-c-mqtt.\n- Check whether your code uses the MQTT 3.1.1 compatibility adapter rather than a native MQTT5 client.","needs_analyst":false,"not_affected_if":["version-fixed","no-mqtt-3.1.1-adapter"],"who_is_affected":"Teams whose clients link aws-c-mqtt in the affected range, typically devices or services built on the AWS Common Runtime or AWS IoT Device SDK for C++ v2. Exposure depends on use of the MQTT 3.1.1 compatibility adapter; the advisory's workarounds point to avoiding it in favor of MQTT5. Systems using only a patched version or no aws-c-mqtt at all can skip this.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000779,"input_tokens":4005,"output_tokens":757,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-115417':3A,93C,113C,190C,324C '-147':134C '-2026':2A,92C,112C,189C,323C '-789':74B,199C '0.16.2':228C '0.9.1':226C '10/22/2026':145C '13':146C '2026':133C '3.1.1':13A,42B,103C,123C,162C,205C,299C,310C '30':147C '65p5':25A,30A,329C '86mr':24A,29A,328C 'acknowledg':330C 'actor':77B,213C 'adapt':15A,44B,105C,125C,207C,301C 'address':234C 'alloc':5A,66B,95C,115C,193C 'attent':142C 'avoid':296C 'aw':18A,31B,47B,55B,59B,108C,128C,135C,137C,152C,171C,179C,237C,272C 'aws-c-mqtt':17A,46B,107C,127C,151C,236C 'aws-security@amazon.com':351C 'broker':269C,292C 'bulletin':131C 'bundl':176C 'c':19A,32B,48B,51B,64B,109C,129C,153C,184C,238C 'c99':157C 'caus':82B,215C 'certain':209C 'client':89B,222C,311C 'code':255C 'collabor':339C 'common':56B,172C 'compat':14A,43B,104C,124C,206C,300C 'complet':319C 'concern':357C 'condit':210C 'connect':264C 'content':138C 'coordin':345C 'core':274C 'could':214C 'crt':174C 'cve':1A,91C,111C,188C,322C 'cwe':73B,198C 'date':144C 'denial':84B,217C 'deriv':254C 'descript':150C 'devic':61B,181C 'disclosur':37B,347C 'distribut':166C 'email':350C 'embed':33B 'enforc':276C 'ensur':250C 'eunho':336C 'exampl':271C 'excess':7A,70B,97C,117C,195C 'exploit':79B 'favor':303C 'feasibl':295C 'fix':262C,315C 'fork':252C 'g3x5':23A,28A,327C 'ghsa':22A,27A,326C 'ghsa-g3x5-86mr-65p5':21A,26A,325C 'id':132C 'identifi':187C 'impact':224C 'implement':158C 'import':140C 'incorpor':259C 'iot':34B,60B,180C,273C 'issu':231C,342C 'kim':337C 'lab':36B 'lab-disclosur':35B 'latest':247C 'librari':52B,202C 'like':333C 'maximum':279C 'memori':4A,67B,94C,114C,192C 'mqtt':12A,20A,38B,41B,49B,102C,110C,122C,130C,154C,161C,204C,239C,268C,298C,309C 'mqtt5':164C,307C 'nativ':306C 'negoti':278C 'new':261C 'on-path':287C 'packag':39B 'packet':280C 'part':168C 'patch':257C 'path':289C 'pdt':149C 'pleas':349C 'pm':148C 'prevent':286C 'process':90B,223C,348C 'public':143C 'question':355C 'recommend':243C 'refer':321C 'remedi':320C 'remot':76B,212C 'requir':141C 'resolut':229C 'respons':293C 'runtim':57B,173C 'scope':136C 'sdk':62B,182C 'secur':354C 'servic':86B,219C 'size':8A,71B,98C,118C,196C,281C 'specif':165C 'tamper':290C 'thank':335C 'tls':284C 'trust':267C 'type':139C 'upgrad':244C,312C 'use':68B,283C 'v0.16.2':241C 'v2':65B,185C 'valu':9A,72B,99C,119C,197C 'version':225C,240C,248C,316C 'vulner':346C 'workaround':263C 'would':332C","nicknames":[],"mitigations":[],"who_affected":"Teams whose clients link aws-c-mqtt in the affected range, typically devices or services built on the AWS Common Runtime or AWS IoT Device SDK for C++ v2. Exposure depends on use of the MQTT 3.1.1 compatibility adapter; the advisory's workarounds point to avoiding it in favor of MQTT5. Systems using only a patched version or no aws-c-mqtt at all can skip this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-147-aws/#GHSA-g3x5-86mr-65p5","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-147-aws/","severity":null,"published_at":"2026-10-22T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-24T20:05:36+00:00","fetched_at":"2026-10-24T20:05:36+00:00","note":"AWS: CVE-2026-115417 - Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt"}],"documents":[{"id":2975,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-147-aws/","title":"AWS: CVE-2026-115417 - Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt","kind":"advisory","source":"lab","text":"CVE-2026-115417 - Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt\n\n### CVE-2026-115417 - Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt\n\nBulletin ID: 2026-147-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/22/2026 13:30 PM PDT\n\nDescription:\n\naws-c-mqtt is a C99 implementation of the MQTT 3.1.1 and MQTT5 specifications, distributed as part of the AWS Common Runtime (CRT) and bundled in the AWS IoT Device SDK for C++ v2. We identified CVE-2026-115417, a memory allocation with excessive size value (CWE-789) in the library's MQTT 3.1.1 compatibility adapter. Under certain conditions, a remote actor could cause a denial of service of the client process.\n\nImpacted versions: >= 0.9.1 AND < 0.16.2\n\nResolution:\n\nThis issue has been addressed in aws-c-mqtt version v0.16.2. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nConnect only to trusted MQTT brokers (for example AWS IoT Core, which enforces the negotiated maximum packet size) and use TLS to prevent on-path tampering of broker responses. Where feasible, avoid the MQTT 3.1.1 compatibility adapter in favor of a native MQTT5 or MQTT 3.1.1 client. Upgrading to a fixed version is the complete remediation.\n\nReferences:\n\n- CVE-2026-115417\n- GHSA-g3x5-86mr-65p5\n\nAcknowledgement:\n\nWe would like to thank Eunho Kim for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":"2026-10-22T00:00:00+00:00","relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}