{"id":"CVE-2026-115417","title":"aws-c-mqtt: aws-c-mqtt: Denial of Service via excessive memory allocation (CVE-2026-115417)","summary":"A flaw was found in aws-c-mqtt. A remote attacker can cause a Denial of Service (DoS) in client applications due to improper memory allocation handling within the MQTT (Message Queuing Telemetry Transport) compatibility adapter. By trigger…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":["CWE-789"],"vendor":"Red Hat","product":"aws-c-mqtt","affected":["aws-c-mqtt >= 0.9.1 < 0.16.2"],"published":"2026-10-22","updated":"2026-10-23","sourceUpdated":"2026-10-23T10:43:41+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115417.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115417.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-115417"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-115417"},{"url":"https://github.com/awslabs/aws-c-mqtt/releases/tag/v0.16.2"},{"url":"https://github.com/awslabs/aws-c-mqtt/security/advisories/GHSA-g3x5-86mr-65p5"},{"url":"https://aws.amazon.com/security/security-bulletins/2026-147-aws/"}],"tags":["csaf","vex","red-hat","cve.org"],"ingestedAt":"2026-10-22T22:00:50.419Z","epss":0.0035,"epssPercentile":0.28487,"slug":"CVE-2026-115417","body":"## Overview\n\nA flaw was found in aws-c-mqtt. A remote attacker can cause a Denial of Service (DoS) in client applications due to improper memory allocation handling within the MQTT (Message Queuing Telemetry Transport) compatibility adapter. By triggering an excessive memory allocation request, an attacker can exhaust available system memory, causing the application to crash or become unresponsive.\n\n## Vendor advisories\n\n- **Red Hat VEX** · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115417.json)\n\n**aws-c-mqtt: aws-c-mqtt: Denial of Service via excessive memory allocation**. Released 2026-10-22, updated 2026-10-23.\n\nNot affected:\n\n- All currently supported Red Hat products\n\n## Remediation\n\nRefer to the advisory for fix availability.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}