CVE-2026-46411
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
FlashMQ before version 1.26.2 allows authorized clients to exceed the permitted over-commit of their write buffer, triggering an internal safe-guard exception. This exception is in a path that cannot be caught, causing a server abort.
Risk Assessment
An attacker can cause the MQTT server to crash, leading to service disruption and potential loss of system availability.
Recommendation
Immediately upgrade FlashMQ to version 1.26.2 or later.
Other vulnerabilities in FlashMQ
See all- CVE-2026-42209Medium
In FlashMQ prior to version 1.26.1, a remote client with retained publish permission can crash the broker when both set_retained_message_defer_timeout and set_retained_message_defer_timeout_spread are configured to non-default values, resulting in denial of service. If anonymous retained publishing is allowed, no authentication is required; otherwise, the attacker needs the corresponding publish permission. The issue is patched in version 1.26.1.
- CVE-2025-62723Medium
FlashMQ is a MQTT broker/server, designed for multi-CPU environments. Prior to version 1.23.2, any authenticated user can create sessions and have them collect QoS messages. When not sent to a client, these are then not released upon (eventual) session expiration. Version 1.23.2 fixes the issue.
Original NVD description (English source)
FlashMQ is a MQTT broker/server, designed for multi-CPU environments. Prior to version 1.26.2, authorized clients have the ability to exceed the permitted over-commit of their write buffer and triggering an internal safe-guard exception. This exception was in a path that was not catchable, and therefore causes a server abort. This issue has been patched in version 1.26.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS