early signals AWS security bulletins

CVE-2026-115417 - Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt

// summary

CVE-2026-115417 is a memory allocation flaw in the MQTT 3.1.1 compatibility adapter of aws-c-mqtt, affecting AWS Common Runtime and IoT SDK components.

// from the source

Bulletin ID: 2026-147-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/22/2026 13:30 PM PDT Description: aws-c-mqtt is a C99 implementation of the MQTT 3.1.1 and MQTT5 specifications, distributed as part of the AWS Common Runtime (CRT) and bundled in the AWS IoT Device SDK for C++ v2. We identified CVE-2026-115417, a memory allocation with excessive size value (CWE-789) in the library's MQTT 3.1.1 compatibility adapter. Under certain conditions, a remote actor cou
Read at aws.amazon.com ↗ More from AWS security bulletins

# more from AWS security bulletins

  1. AWS security bulletins

    CVE-2026-115845 - Incomplete validation in the run_script Python sandbox in AWS MCP Server

    aws.amazon.com
  2. AWS security bulletins

    CVE-2026-115812 and CVE-2026-115813: Issue in Amazon Web Services Multi Model Server

    aws.amazon.com
  3. AWS security bulletins infra

    CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server

    aws.amazon.com
  4. AWS security bulletins

    CVE-2026-87911

    aws.amazon.com
  5. AWS security bulletins infra

    CVE-2026-85788 - Issue with awslabs mysql-mcp-server

    aws.amazon.com