Remote Denial of Service in FlashMQ MQTT Broker

CVE-2026-42209

What is CVE-2026-42209?

A vulnerability exists in FlashMQ, an MQTT broker/server designed for multi-CPU environments, where prior to version 1.26.1, it can be subjected to a denial of service. This occurs when a remote client with retained publish permission triggers the broker to crash by setting both the 'set_retained_message_defer_timeout' and 'set_retained_message_defer_timeout_spread' to non-default values. If anonymous retained publishing is enabled, the attacker can exploit this without authentication; otherwise, they need the necessary publish permissions. This vulnerability has been addressed in version 1.26.1.

References