Description
Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in AWS aws-c-mqtt before 0.16.2 might allow a remote actor to cause a denial of service of the client application.



To remediate this issue, users should upgrade to aws-c-mqtt 0.16.2 or later, or to an AWS Common Runtime or AWS IoT Device SDK release that bundles it.
Published: 2026-10-22
Score: 8.2 High
EPSS: n/a
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Description Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in AWS aws-c-mqtt before 0.16.2 might allow a remote actor to cause a denial of service of the client application. To remediate this issue, users should upgrade to aws-c-mqtt 0.16.2 or later, or to an AWS Common Runtime or AWS IoT Device SDK release that bundles it.
Title Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt
First Time appeared Aws
Aws aws-c-mqtt
Weaknesses CWE-789
CPEs cpe:2.3:a:aws:aws-c-mqtt:*:*:*:*:*:*:*:*
Vendors & Products Aws
Aws aws-c-mqtt
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Aws Aws-c-mqtt
cve-icon MITRE

Status: PUBLISHED

Assigner: AMZN

Published:

Updated: 2026-10-22T20:34:50.961Z

Reserved: 2026-10-22T13:18:17.258Z

Link: CVE-2026-115417

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-22T21:17:17.633

Modified: 2026-10-22T21:17:17.633

Link: CVE-2026-115417

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses