CVE-2026-115417: aws-c-mqtt, отказ на услуга

Описание

Оригинално описание

Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in AWS aws-c-mqtt before 0.16.2 might allow a remote actor to cause a denial of service of the client application. To remediate this issue, users should upgrade to aws-c-mqtt 0.16.2 or later, or to an AWS Common Runtime or AWS IoT Device SDK release that bundles it.

Засегнати продукти

• AWS aws-c-mqtt: 0.9.1 преди 0.16.2

Вид слабост

• CWE-789 Memory Allocation with Excessive Size Value

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-115417
• https://nvd.nist.gov/vuln/detail/CVE-2026-115417
• https://github.com/awslabs/aws-c-mqtt/releases/tag/v0.16.2
• https://github.com/awslabs/aws-c-mqtt/security/advisories/GHSA-g3x5-86mr-65p5
• https://aws.amazon.com/security/security-bulletins/2026-147-aws/