AmazonAnalysisAmazon Web Services patches MQTT compatibility adapter memory exhaustion flaw
What happened.Amazon Web Services published security bulletin AWS-2026-147 addressing a high-severity memory allocation vulnerability within its open-source MQTT client library.
Why it matters.Embedded IoT microcontrollers and edge gateways rely on lightweight MQTT daemon connections to stream telemetry and process commands. Memory exhaustion crashes can sever telemetry pipelines and trigger physical reboot loops across remote hardware fleets. Hardware teams must update bundled Common Runtime libraries in upcoming firmware builds and ensure edge broker connections use mutual TLS.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-115417 with a 7.5 CVSS score, improper packet boundary validation in the MQTT 3.1.1 compatibility adapter causes uncontrolled memory allocation during incoming frame processing.
- Exploitation path: Malicious MQTT brokers or network adversaries transmit crafted packets that trigger out-of-memory crashes on connected client devices.
- Remediation releases: AWS fixed the allocation handling in aws-c-mqtt version 0.16.2 and updated dependent packages across the AWS Common Runtime and IoT Device SDK for C++ v2.