---
id: CVE-2026-115417
title: >-
  aws-c-mqtt: aws-c-mqtt: Denial of Service via excessive memory allocation
  (CVE-2026-115417)
summary: >-
  A flaw was found in aws-c-mqtt. A remote attacker can cause a Denial of
  Service (DoS) in client applications due to improper memory allocation
  handling within the MQTT (Message Queuing Telemetry Transport) compatibility
  adapter. By trigger…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-789
vendor: Red Hat
product: aws-c-mqtt
affected:
  - aws-c-mqtt >= 0.9.1 < 0.16.2
published: '2026-10-22'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T10:43:41+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115417.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115417.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-115417'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-115417'
  - url: 'https://github.com/awslabs/aws-c-mqtt/releases/tag/v0.16.2'
  - url: >-
      https://github.com/awslabs/aws-c-mqtt/security/advisories/GHSA-g3x5-86mr-65p5
  - url: 'https://aws.amazon.com/security/security-bulletins/2026-147-aws/'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
ingestedAt: '2026-10-22T22:00:50.419Z'
epss: 0.0035
epssPercentile: 0.28487
---

## Overview

A flaw was found in aws-c-mqtt. A remote attacker can cause a Denial of Service (DoS) in client applications due to improper memory allocation handling within the MQTT (Message Queuing Telemetry Transport) compatibility adapter. By triggering an excessive memory allocation request, an attacker can exhaust available system memory, causing the application to crash or become unresponsive.

## Vendor advisories

- **Red Hat VEX** · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115417.json)

**aws-c-mqtt: aws-c-mqtt: Denial of Service via excessive memory allocation**. Released 2026-10-22, updated 2026-10-23.

Not affected:

- All currently supported Red Hat products

## Remediation

Refer to the advisory for fix availability.