CVE-2026-46411

MediumCVSS 6.5

Published: 10/06/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

22th percentile - higher than 22% of all known CVEs

Summary

FlashMQ before version 1.26.2 allows authorized clients to exceed the permitted over-commit of their write buffer, triggering an internal safe-guard exception. This exception is in a path that cannot be caught, causing a server abort.

Risk Assessment

An attacker can cause the MQTT server to crash, leading to service disruption and potential loss of system availability.

Recommendation

Immediately upgrade FlashMQ to version 1.26.2 or later.

Other vulnerabilities in FlashMQ

CVE-2025-62723Medium
FlashMQ is a MQTT broker/server, designed for multi-CPU environments. Prior to version 1.23.2, any authenticated user can create sessions and have them collect QoS messages. When not sent to a client, these are then not released upon (eventual) session expiration. Version 1.23.2 fixes the issue.

Original NVD description (English source)

FlashMQ is a MQTT broker/server, designed for multi-CPU environments. Prior to version 1.26.2, authorized clients have the ability to exceed the permitted over-commit of their write buffer and triggering an internal safe-guard exception. This exception was in a path that was not catchable, and therefore causes a server abort. This issue has been patched in version 1.26.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS