What’s Vulnerable › Vulnerabilities

CVE-2026-8686: DoS from MQTT v5.0 Deserialization Fault in core MQTT

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-15 · updated 2026-10-25
• Weakness: CWE-125

Description

Missing bounds validation in the MQTT v5.0 property parser in coreMQTT before 5.0.1 allows an MQTT broker to cause a denial of service by sending a crafted packet. To remediate this issue, users should upgrade to v5.0.1.

Affected products

• FreeRTOS coreMQTT: 5.0.0

References

• https://aws.amazon.com/security/security-bulletins/2026-032-aws/
• https://github.com/FreeRTOS/coreMQTT/releases/tag/v5.0.1
• https://github.com/FreeRTOS/coreMQTT/security/advisories/GHSA-6qh9-r6jp-2wxc

Get alerted when CVE-2026-8686 or the next vulnerability affects your stack