Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Public exploit
- None on Exploit-DB
Summary
The aws-c-mqtt library, which is used for MQTT messaging in AWS Common Runtime and AWS IoT Device SDK client applications, contains a flaw in its MQTT 3.1.1 compatibility adapter. A remote attacker could potentially trigger an excessively large memory allocation, causing the client application to crash or become unavailable.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in AWS aws-c-mqtt before 0.16.2 might allow a remote actor to cause a denial of service of the client application. To remediate this issue, users should upgrade to aws-c-mqtt 0.16.2 or later, or to an AWS Common Runtime or AWS IoT Device SDK release that bundles it.
Affected versions
- AWS aws-c-mqtt
From 0.9.1 · fixed in 0.16.2