CVE-2026-46411

June 10, 2026, 12:16 a.m.

6.5
Medium

Description

FlashMQ is a MQTT broker/server, designed for multi-CPU environments. Prior to version 1.26.2, authorized clients have the ability to exceed the permitted over-commit of their write buffer and triggering an internal safe-guard exception. This exception was in a path that was not catchable, and therefore causes a server abort. This issue has been patched in version 1.26.2.

Product(s) Impacted

Vendor Product Versions
Flashmq
  • Flashmq
  • *

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-248
Uncaught Exception
An exception is thrown from a function, but it is not caught.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a flashmq flashmq / / / / / / / /

References

https://github.com/halfgaar/FlashMQ/commit/29e08f7b97b6e3f96db923c2b6a260c47b49c195
https://github.com/halfgaar/FlashMQ/releases/tag/v1.26.2
https://github.com/halfgaar/FlashMQ/security/advisories/GHSA-g35r-265r-rxrh

Tags

[email protected]
CWE-248
2026-06-10
CVE-2026-46411

CVSS Score

6.5 / 10

CVSS Data - 3.1

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Privileges Required: LOW
  • Scope: UNCHANGED
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: HIGH

    • CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

    View Vector String

Timeline

Published: June 10, 2026, 12:16 a.m.
Last Modified: June 10, 2026, 12:16 a.m.

Status : Received

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

[email protected]

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.