Memory Allocation Vulnerability in AWS MQTT 3.1.1 Adapter
CVE-2026-115417

8.2HIGH

Key Information:

Vendor

Aws

Status
Aws-c-MQtt
Vendor
CVE Published:
22 October 2026

What is CVE-2026-115417?

A memory allocation vulnerability exists in the MQTT 3.1.1 compatibility adapter of AWS aws-c-mqtt prior to version 0.16.2. This flaw enables a remote attacker to send excessive size values, potentially leading to a denial of service in the client application. To mitigate this risk, it is essential for users to upgrade to aws-c-mqtt version 0.16.2 or later, or to utilize an AWS Common Runtime or the AWS IoT Device SDK that integrates this version.

Affected Version(s)

aws-c-mqtt 0.9.1 < 0.16.2

References

https://github.com/awslabs/aws-c-mqtt/releases/tag/v0.16.2
release-notespatch
https://github.com/awslabs/aws-c-mqtt/security/advisories...
third-party-advisory
https://aws.amazon.com/security/security-bulletins/2026-1...
vendor-advisory

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.