High 7.5Published Oct 22, 2026

CVE-2026-115417Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt

Updated under an hour ago (Oct 28, 2026, 12:50 PM ET)

Does this affect you?

It affects aws-c-mqtt. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.35%, higher than 28% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for aws-c-mqtt

Exploited in the last 30 days

Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in AWS aws-c-mqtt before 0.16.2 might allow a remote actor to cause a denial of service of the client application. To remediate this issue, users should upgrade to aws-c-mqtt 0.16.2 or later, or to an AWS Common Runtime or AWS IoT Device SDK release that bundles it.

CVSS: 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-789
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.35% (percentile 28)
Assigned by: AMZN
NVD analysis: Awaiting Analysis
Record last updated: Oct 22, 2026
First seen by InfoSec Signals: Oct 22, 2026

Affected products

Affected products

AWS aws-c-mqtt aws:c_mqtt (from the name)	from 0.9.1 before 0.16.2	CNA record

References

References

https://github.com/awslabs/aws-c-mqtt/releases/tag/v0.16.2	release-notes, patch
https://github.com/awslabs/aws-c-mqtt/security/advisories/GHSA-g3x5-86mr-65p5	third-party-advisory
https://aws.amazon.com/security/security-bulletins/2026-147-aws/	vendor-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.