CVE-2026-42209

6.5 Moyenne

Publiée le 09/05/2026 à 00:16 · Modifiée le 17/06/2026 à 12:47 · Analyse NVD reportée · Source : security-advisories@github.com

Description

FlashMQ is a MQTT broker/server, designed for multi-CPU environments. Prior to version 1.26.1, a remote client with retained publish permission can crash the FlashMQ broker when both set_retained_message_defer_timeout and set_retained_message_defer_timeout_spread are configured to non-default values, resulting in denial of service. If anonymous retained publishing is allowed, no authentication is required; otherwise, the attacker needs the corresponding publish permission. This issue has been patched in version 1.26.1.

Traduire en français

Produits concernés

halfgaar FlashMQ

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.5 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`

Faiblesses (CWE)

CWE-369

Références

https://github.com/halfgaar/FlashMQ/commit/193b6e7767889511cfa8e933908ea5e6a1077a1f
https://github.com/halfgaar/FlashMQ/issues/167
https://github.com/halfgaar/FlashMQ/releases/tag/v1.26.1
https://github.com/halfgaar/FlashMQ/security/advisories/GHSA-2789-vfcg-5922
https://github.com/halfgaar/FlashMQ/issues/167

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories