CVE-2026-115417: CWE-789 Memory allocation with excessive size value in AWS aws-c-mqtt
Description
CVE-2026-115417 is a high-severity vulnerability in the AWS aws-c-mqtt library before version 0.16.2. It involves memory allocation with an excessive size value in the MQTT 3.1.1 compatibility adapter, which could allow a remote attacker to cause a denial of service (DoS) of the client application. The issue is fixed in aws-c-mqtt version 0.16.2 and later. Users should upgrade to these versions or to an AWS Common Runtime or AWS IoT Device SDK release that includes the fix.
CVSS v3.1
7.5high
Affected software
AWS
aws-c-mqtt
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2026-115417) affects the aws-c-mqtt library versions from 0.9.1 up to but not including 0.16.2. It arises from improper handling of memory allocation requests with excessive size values in the MQTT 3.1.1 compatibility adapter, potentially leading to denial of service by exhausting client application resources. The vulnerability has a CVSS 3.1 score of 7.5 (high severity) with network attack vector, low attack complexity, no privileges or user interaction required, and impacts availability only. AWS has released aws-c-mqtt version 0.16.2 to remediate this issue. Additionally, AWS Common Runtime and AWS IoT Device SDK releases bundling this fixed version also address the vulnerability.
Potential Impact
A remote attacker can exploit this vulnerability to cause a denial of service condition in the client application using the vulnerable aws-c-mqtt library. This results in disruption of service availability but does not affect confidentiality or integrity.
Mitigation Recommendations
A patch is available. Users should upgrade to aws-c-mqtt version 0.16.2 or later. Alternatively, upgrading to an AWS Common Runtime or AWS IoT Device SDK release that bundles the fixed aws-c-mqtt version also mitigates the issue. Since this is a client library, applying the update in client applications is necessary to remediate the vulnerability.
Technical Details
- Assigned by
- AMZN
- Reserved
- 10/22/2026
- CVSS version
- 3.1
- Is Cloud Service
- true
- Vendor Advisory Urls
- [object Object]
Threat ID: 6adc6dc15a5d48fa0dab3a91
Added to database: 10/24/2026, 08:35:13 UTC
Last enriched: 10/24/2026, 08:36:43 UTC
Last updated: 10/24/2026, 09:45:21 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.