Bug 2559386 (CVE-2026-115417)

Summary: CVE-2026-115417 aws-c-mqtt: aws-c-mqtt: Denial of Service via excessive memory allocation
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in aws-c-mqtt. A remote attacker can cause a Denial of Service (DoS) in client applications due to improper memory allocation handling within the MQTT (Message Queuing Telemetry Transport) compatibility adapter. By triggering an excessive memory allocation request, an attacker can exhaust available system memory, causing the application to crash or become unresponsive.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2559500, 2559496, 2559497, 2559498    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-22 21:02:54 UTC 
Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in AWS aws-c-mqtt before 0.16.2 might allow a remote actor to cause a denial of service of the client application.



To remediate this issue, users should upgrade to aws-c-mqtt 0.16.2 or later, or to an AWS Common Runtime or AWS IoT Device SDK release that bundles it.