PT-2026-41372 · Coremqtt · Coremqtt

Epsilon · Published 2026-05-15 · Updated 2026-05-19 · CVE-2026-8686

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions coreMQTT versions prior to 5.0.1

Description Missing bounds validation in the MQTT v5.0 property parser allows an MQTT broker to cause a denial of service by sending a crafted packet.

Recommendations Upgrade to version 5.0.1.

Exploit

Fix

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-8686

GHSA-6QH9-R6JP-2WXC

Affected Products

Coremqtt

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8686.json · Exploit
• https://github.com/FreeRTOS/coreMQTT/releases/tag/v5.0.1 · Patch
• https://github.com/FreeRTOS/coreMQTT/security/advisories/GHSA-6qh9-r6jp-2wxc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-8686 · Security Note
• https://aws.amazon.com/security/security-bulletins/2026-032-aws · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-8686 · Vendor Advisory
• https://t.me/cveNotify/164007 · Telegram Post