CVE-2026-115417GHSA-g3x5-86mr-65p5
Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt
AWS aws-c-mqttContainers & cloud
CVSS
7.5HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.35%Chance of exploitation activity in the next 30 days, higher than 27% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 0.16.2aws-c-mqttCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in AWS aws-c-mqtt before 0.16.2 might allow a remote actor to cause a denial of service of the client application.
To remediate this issue, users should upgrade to aws-c-mqtt 0.16.2 or later, or to an AWS Common Runtime or AWS IoT Device SDK release that bundles it.
Text from CVE List
Affected versions 1
- aws-c-mqttaffected: 0.9.1 before 0.16.2CVE List