CVE-2026-8686
criticalMissing bounds validation in the MQTT v5.0 property parser in coreMQTT before 5.0.1 allows an MQTT broker to cause a denial of service by sending a crafted pac…
Vendor / product: Freertos — coremqtt
Missing bounds validation in the MQTT v5.0 property parser in coreMQTT before 5.0.1 allows an MQTT broker to cause a denial of service by sending a crafted packet. To remediate this issue, users should upgrade to v5.0.1.
CVSS
9.1
9.1 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2026-05-15 19:17
Modified: 2026-10-25 23:10
NVD status: Analyzed
Last synced 2 days ago
Verified against the source API 2026-10-27 07:07 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
freertos / coremqtt 5.0.0
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Vendor advisory: https://aws.amazon.com/security/security-bulletins/2026-032-aws/
References
- https://aws.amazon.com/security/security-bulletins/2026-032-aws/ ff89ba41-3aa1-4d27-914a-91399e9639e5
- https://github.com/FreeRTOS/coreMQTT/releases/tag/v5.0.1 ff89ba41-3aa1-4d27-914a-91399e9639e5
- https://github.com/FreeRTOS/coreMQTT/security/advisories/GHSA-6qh9-r6jp-2wxc ff89ba41-3aa1-4d27-914a-91399e9639e5
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 07:07 UTC · record ↗