AWS aws-c-mqtt 0.16.2 Fixes MQTT Adapter Remote Denial of Service
Tech GuruQuick Answer
AWS bulletin 2026-147-AWS fixes CVE-2026-115417 in aws-c-mqtt 0.9.1 through releases before 0.16.2. Upgrade the library, validate adapter use and broker trust, test client resilience, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory aws-c-mqtt versions, MQTT 3.1.1 compatibility-adapter use, brokers, TLS configuration, embedded copies, forks, clients, and owners. Confirm that each application uses the affected compatibility adapter and can receive broker responses; do not infer exposure from MQTT or AWS IoT use alone. Upgrade to aws-c-mqtt 0.16.2 or later and patch forks; until then, connect only to trusted brokers over TLS and prefer a native MQTT client where feasible. Confirm the loaded library, exercise connection and malformed-response handling in a safe test, monitor client restarts, and retain dependency and deployment evidence.
Last verified: 2026-10-23 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | aws-c-mqtt MQTT 3.1.1 compatibility adapter |
|---|---|
| Advisory | 2026-147-AWS |
| CVE | CVE-2026-115417 |
| Authoritative release date | 2026-10-22 20:40:51 UTC |
| Authority revision date | 2026-10-22 20:40:51 UTC |
| Affected versions | aws-c-mqtt 0.9.1 through releases before 0.16.2 when the MQTT 3.1.1 compatibility adapter processes a malicious or tampered broker response. |
| Fixed version | aws-c-mqtt 0.16.2 or later |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | AWS does not state that this issue is being maliciously exploited.; no exploitation claim is inferred. |
What Changed
AWS fixed excessive memory allocation in the MQTT 3.1.1 compatibility adapter that can allow a remote actor to terminate the client process.
What To Validate Now
- Inventory. Inventory aws-c-mqtt versions, MQTT 3.1.1 compatibility-adapter use, brokers, TLS configuration, embedded copies, forks, clients, and owners.
- Establish applicability. Confirm that each application uses the affected compatibility adapter and can receive broker responses; do not infer exposure from MQTT or AWS IoT use alone.
- Remediate. Upgrade to aws-c-mqtt 0.16.2 or later and patch forks; until then, connect only to trusted brokers over TLS and prefer a native MQTT client where feasible.
- Validate. Confirm the loaded library, exercise connection and malformed-response handling in a safe test, monitor client restarts, and retain dependency and deployment evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Trusted brokers and TLS reduce risk but do not replace the update, and availability impact depends on how the application supervises and restarts the affected client process.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
