CVE-2026-46411

FlashMQ is a MQTT broker/server, designed for multi-CPU environments. Prior to version 1.26.2, authorized clients have the ability to exceed the permitted over-commit of their write buffer and triggering an internal safe-guard exception. This exception was in a path that was not catchable, and therefore causes a server abort. This issue has been patched in version 1.26.2.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/halfgaar/FlashMQ/commit/29e08f7b97b6e3f96db923c2b6a260c47b49c195
https://github.com/halfgaar/FlashMQ/releases/tag/v1.26.2
https://github.com/halfgaar/FlashMQ/security/advisories/GHSA-g35r-265r-rxrh

Configurations

No configuration.

History

No history.

Information

Published : 2026-06-10 00:16

Updated : 2026-07-23 09:10

NVD link : CVE-2026-46411

Mitre link : CVE-2026-46411

CVE.ORG link : CVE-2026-46411

JSON object : View

Products Affected

No product.

CWE

CWE-248

Uncaught Exception

{"id": "CVE-2026-46411", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46411", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-10T14:30:14.609160Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "halfgaar", "product": "FlashMQ", "versions": [{"status": "affected", "version": "< 1.26.2"}]}]}], "published": "2026-06-10T00:16:53.407", "references": [{"url": "https://github.com/halfgaar/FlashMQ/commit/29e08f7b97b6e3f96db923c2b6a260c47b49c195", "source": "security-advisories@github.com"}, {"url": "https://github.com/halfgaar/FlashMQ/releases/tag/v1.26.2", "source": "security-advisories@github.com"}, {"url": "https://github.com/halfgaar/FlashMQ/security/advisories/GHSA-g35r-265r-rxrh", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-248"}]}], "descriptions": [{"lang": "en", "value": "FlashMQ is a MQTT broker/server, designed for multi-CPU environments. Prior to version 1.26.2, authorized clients have the ability to exceed the permitted over-commit of their write buffer and triggering an internal safe-guard exception. This exception was in a path that was not catchable, and therefore causes a server abort. This issue has been patched in version 1.26.2."}, {"lang": "es", "value": "FlashMQ es un broker/servidor MQTT, dise\u00f1ado para entornos multi-CPU. Antes de la versi\u00f3n 1.26.2, los clientes autorizados tienen la capacidad de exceder el sobrecompromiso permitido de su b\u00fafer de escritura y desencadenar una excepci\u00f3n de salvaguarda interna. Esta excepci\u00f3n estaba en una ruta que no era capturable y, por lo tanto, causa un aborto del servidor. Este problema ha sido parcheado en la versi\u00f3n 1.26.2."}], "lastModified": "2026-07-23T09:10:00.113", "sourceIdentifier": "security-advisories@github.com"}