{"schema":"threatline.record/2","record":{"id":"CVE-2026-115417","aliases":["GHSA-g3x5-86mr-65p5"],"summary":"Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt","details":"Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in AWS aws-c-mqtt before 0.16.2 might allow a remote actor to cause a denial of service of the client application.\n\n\n\nTo remediate this issue, users should upgrade to aws-c-mqtt 0.16.2 or later, or to an AWS Common Runtime or AWS IoT Device SDK release that bundles it.","categories":["Containers & cloud"],"product":"aws-c-mqtt","vendor":"AWS","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115417","source_modified_at":"2026-10-22T20:34:50.961Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"aws-c-mqtt","vendor":"AWS","versions":[{"status":"affected","version":"0.9.1","lessThan":"0.16.2","versionType":"custom"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115417","source_modified_at":"2026-10-22T20:34:50.961Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"aws-c-mqtt","ecosystem":null},"version":"0.16.2","basis":"first unaffected version stated in the CVE record"}],"cvss":7.5,"severity":"High","kev":{"listed":false},"epss":{"probability":0.0035,"percentile":0.27469,"score_date":"2026-10-23"},"published_at":"2026-10-22T20:34:50.961Z","modified_at":"2026-10-22T20:34:50.961Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-115417","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-22T20:34:50.961Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115417","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/awslabs/aws-c-mqtt/releases/tag/v0.16.2","tags":["release-notes","patch"]},{"source":"CVE List","url":"https://github.com/awslabs/aws-c-mqtt/security/advisories/GHSA-g3x5-86mr-65p5","tags":["third-party-advisory"]},{"source":"CVE List","url":"https://aws.amazon.com/security/security-bulletins/2026-147-aws/","tags":["vendor-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-22T20:34:50.961Z","content_hash":"c516fd9e72c9ca8caae6630dee4eb67aafe759459b053646ceb27cf11d6465a7"}}