CVE-2026-115417: Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt
Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in AWS aws-c-mqtt before 0.16.2 might allow a remote actor to cause a denial of service of the client application.
To remediate this issue, users should upgrade to aws-c-mqtt 0.16.2 or later, or to an AWS Common Runtime or AWS IoT Device SDK release that bundles it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
aws/aws-c-mqttto a version that resolves this vulnerability.Fixed in 0.16.2
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Client applications using aws-c-mqtt versions before 0.16.2 are affected. Applications using an AWS Common Runtime or AWS IoT Device SDK release that bundles a vulnerable aws-c-mqtt version may also be affected.
What does an attacker need to exploit the issue?
The vulnerability is remotely exploitable with low attack complexity and requires no privileges or user interaction. Successful exploitation may cause a denial of service in the client application.
Is there a workaround if the application cannot be updated directly?
Upgrade aws-c-mqtt to version 0.16.2 or later. If it is supplied transitively, upgrade to an AWS Common Runtime or AWS IoT Device SDK release that bundles the fixed version.