AWS aws-c-mqtt: Denial of service via excessive memory allocation in MQTT 3.1.1 adapter
Summary
The MQTT 3.1.1 compatibility adapter in the aws-c-mqtt C library, part of the AWS Common Runtime and the AWS IoT Device SDK for C++ v2, allocates memory using an excessively large size value. A remote actor may be able to exhaust resources and crash the client application, causing a denial of service. Per AWS, exploitation requires certain conditions, and the realistic threat is a malicious or compromised broker or an on-path attacker that can tamper with broker responses.
Affected
- AWS aws-c-mqtt versions 0.9.1 up to but not including 0.16.2
- Products, firmware and SDKs that bundle an affected aws-c-mqtt version, such as the AWS IoT Device SDK for C++ v2 and AWS Common Runtime builds
Fixed in
- aws-c-mqtt 0.16.2 (AWS and GitHub release v0.16.2)
- Vendor builds of the AWS Common Runtime or AWS IoT Device SDK that bundle aws-c-mqtt 0.16.2 or later
- Forked or derivative code must be patched separately
Workaround
- Connect only to trusted MQTT brokers, for example AWS IoT Core, which enforces the negotiated maximum packet size
- Use TLS to prevent on-path tampering of broker responses
- Where feasible, avoid the MQTT 3.1.1 compatibility adapter and use a native MQTT5 or MQTT 3.1.1 client
- These are vendor suggestions; upgrading to a fixed version is the complete remediation
Exploitation
- Public proof-of-concept exploit: none found
- Known exploitation in the wild: no evidence found
- CISA SSVC: exploitation none, automatable yes, technical impact partial
- CVSS 4.0 base score 8.2 (High), attack requirements present
Our recommendation
- Inventory systems, firmware and software packages for aws-c-mqtt and the AWS IoT Device SDK for C++, for example via SBOMs or package lists
- Update to aws-c-mqtt 0.16.2 or later, or obtain a vendor build that includes the fix; ask device vendors for firmware updates where you cannot patch yourself
- Until patched, restrict MQTT clients to known brokers and enforce TLS
- Monitor vendor advisories for updates
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- AWS Security Bulletin 2026-147-AWS aws.amazon.com
- aws-c-mqtt release v0.16.2 github.com
- GitHub Security Advisory GHSA-g3x5-86mr-65p5 github.com
- VulDB entry 425463 vuldb.com
- Tenable CVE-2026-115417 www.tenable.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:08.
Original description (NVD)
Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in AWS aws-c-mqtt before 0.16.2 might allow a remote actor to cause a denial of service of the client application. To remediate this issue, users should upgrade to aws-c-mqtt 0.16.2 or later, or to an AWS Common Runtime or AWS IoT Device SDK release that bundles it.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.