Aws C Mqtt
Monthly
Denial of service in the MQTT5-to-MQTT 3.1.1 compatibility adapter of AWS aws-c-mqtt (versions 0.9.1 through 0.16.1) allows a hostile or impersonated MQTT broker to trigger an excessive memory allocation that crashes the client process, and the crash can recur if the application automatically restarts and reconnects. Exploitation requires that the application uses the compatibility adapter and either connects to an attacker-controlled broker or has its broker traffic tampered with on-path (assessed CVSS 3.1: AV:N/AC:H/PR:N/UI:N/A:H; vendor CVSS 4.0: 8.2 with AT:P). No public exploit identified at time of analysis and no CISA KEV listing; the vendor-released fix is aws-c-mqtt 0.16.2, also bundled in aws-crt-cpp v0.43.9 and AWS IoT Device SDK for C++ v2 v1.45.1.
Denial of service in the MQTT5-to-MQTT 3.1.1 compatibility adapter of AWS aws-c-mqtt (versions 0.9.1 through 0.16.1) allows a hostile or impersonated MQTT broker to trigger an excessive memory allocation that crashes the client process, and the crash can recur if the application automatically restarts and reconnects. Exploitation requires that the application uses the compatibility adapter and either connects to an attacker-controlled broker or has its broker traffic tampered with on-path (assessed CVSS 3.1: AV:N/AC:H/PR:N/UI:N/A:H; vendor CVSS 4.0: 8.2 with AT:P). No public exploit identified at time of analysis and no CISA KEV listing; the vendor-released fix is aws-c-mqtt 0.16.2, also bundled in aws-crt-cpp v0.43.9 and AWS IoT Device SDK for C++ v2 v1.45.1.