Denial of Service Vulnerability in coreMQTT by FreeRTOS
CVE-2026-8686

8.7HIGH

Key Information:

Vendor

Freertos

Status
CoreMQtt
Vendor
CVE Published:
15 May 2026

What is CVE-2026-8686?

A vulnerability in the MQTT v5.0 property parser allows an MQTT broker to trigger a denial of service condition by sending specially crafted packets. This issue affects coreMQTT versions prior to 5.0.1. Users are advised to upgrade to the latest version to mitigate potential security risks.

Affected Version(s)

coreMQTT 5.0.0

References

https://github.com/FreeRTOS/coreMQTT/releases/tag/v5.0.1
patch
https://aws.amazon.com/security/security-bulletins/2026-0...
vendor-advisory
https://github.com/FreeRTOS/coreMQTT/security/advisories/...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Epsilon
.