HIGH
DoS from MQTT v5.0 Deserialization Fault in core MQTT
Published May 15, 2026
8.7
HIGHCVSS 4.0
EPSS 0.68%
Description
Missing bounds validation in the MQTT v5.0 property parser in coreMQTT before 5.0.1 allows an MQTT broker to cause a denial of service by sending a crafted packet.
To remediate this issue, users should upgrade to v5.0.1.
Affected products
-
- Version 5.0.0StatusaffectedConstraints-
- Version
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (4)
- https://aws.amazon.com/security/security-bulletins/2026-032-aws/ vendor-advisoryVendor Advisory
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-30581 Advisory
- https://github.com/FreeRTOS/coreMQTT/releases/tag/v5.0.1 patchRelease Notes
- https://github.com/FreeRTOS/coreMQTT/security/advisories/GHSA-6qh9-r6jp-2wxc third-party-advisoryVendor Advisory
| Link | Providers | Tags |
|---|---|---|
| https://aws.amazon.com/security/security-bulletins/2026-032-aws/ | vendor-advisoryVendor Advisory | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-30581 | Advisory | |
| https://github.com/FreeRTOS/coreMQTT/releases/tag/v5.0.1 | patchRelease Notes | |
| https://github.com/FreeRTOS/coreMQTT/security/advisories/GHSA-6qh9-r6jp-2wxc | third-party-advisoryVendor Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner AMZN
Published May 15, 2026
Updated May 15, 2026
Reserved May 15, 2026
Link CVE-2026-8686
CISA Vulnrichment
Updated May 15, 2026
ENISA EUVD
EUVD-2026-30581 Assigner AMZN
Published May 15, 2026
Updated May 15, 2026
Exploited since n/a
Link EUVD-2026-30581