CVE-2026-46411: FlashMQ MQTT Broker DoS Vulnerability

CVE-2026-46411 Overview

CVE-2026-46411 is a denial of service vulnerability in FlashMQ, an MQTT broker designed for multi-CPU environments. Authorized clients can exceed the permitted over-commit of their write buffer, triggering an internal safe-guard exception. The exception occurs in a code path that cannot be caught, causing the broker process to abort. The flaw is categorized under [CWE-248] (Uncaught Exception) and affects all FlashMQ versions prior to 1.26.2. Maintainers patched the issue in version 1.26.2.

Critical Impact
Any authenticated MQTT client can crash the FlashMQ broker remotely, disrupting message delivery across all connected publishers and subscribers.

Affected Products

FlashMQ MQTT broker versions prior to 1.26.2
Deployments exposing FlashMQ to authenticated clients over the network
Multi-CPU MQTT messaging environments built on FlashMQ

Discovery Timeline

2026-06-10 - CVE-2026-46411 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-46411

Vulnerability Analysis

FlashMQ allocates per-client write buffers and permits a bounded amount of over-commit to accommodate bursty publish traffic. The broker enforces this bound with an internal safe-guard that throws an exception when a client exceeds the allowed over-commit. In affected releases, the throw site sits inside an execution path that lacks a surrounding handler. When the exception propagates beyond the protected scope, the C++ runtime invokes process termination, and the broker aborts. All connected clients lose their sessions and queued messages tied to the running process state.

The condition requires valid credentials, so unauthenticated attackers cannot trigger it directly. However, MQTT deployments often grant publish permissions to many devices, and any one of them can use this flaw to take the broker offline.

Root Cause

The root cause is an uncaught exception [CWE-248] inside the write-buffer over-commit check. The safe-guard correctly detects the policy violation but raises an exception in a code path that has no matching catch block. C++ unwinding terminates the process when no handler matches. The maintainer fix in commit 29e08f7b97b6e3f96db923c2b6a260c47b49c195 resolves the abort path so the broker handles the buffer condition gracefully.

Attack Vector

Exploitation requires network reach to the MQTT listener and valid client credentials. An authorized client connects, then issues publish or subscribe traffic structured to inflate the server-side write buffer beyond the permitted over-commit. The internal safe-guard fires, the exception propagates, and the broker aborts. No memory corruption or code execution occurs. The impact is limited to availability. Technical details are documented in the FlashMQ Security Advisory GHSA-g35r-265r-rxrh.

Detection Methods for CVE-2026-46411

Indicators of Compromise

Unexpected FlashMQ process termination with SIGABRT in system logs or systemd journal entries
Mass client reconnection events immediately following a broker abort
Single authenticated client generating abnormally large outbound message volume prior to a crash

Detection Strategies

Monitor FlashMQ service exit codes and restart counts through the service manager controlling the broker
Correlate broker abort timestamps with the last active client identifiers and source IP addresses recorded in FlashMQ access logs
Alert on repeated short-lived broker processes, which indicate a client triggering the abort and reconnecting

Monitoring Recommendations

Ship FlashMQ logs and systemd journal events to a centralized logging platform for retrospective analysis
Track per-client publish rate, payload size, and subscription fan-out to identify clients capable of inflating server write buffers
Enable alerts on broker uptime regressions and on any client reaching publish quotas tied to write-buffer growth

How to Mitigate CVE-2026-46411

Immediate Actions Required

Upgrade FlashMQ to version 1.26.2 or later on all broker hosts
Audit MQTT credentials and revoke any client account that does not require active access
Restrict broker network exposure so only trusted client networks reach the MQTT listener

Patch Information

The issue is fixed in FlashMQ 1.26.2. The corrective change is recorded in GitHub Commit 29e08f7b and shipped in the FlashMQ v1.26.2 Release. Operators should review the FlashMQ Security Advisory GHSA-g35r-265r-rxrh for full remediation guidance.

Workarounds

Limit MQTT client permissions to the minimum publish and subscribe topics required for each device
Place FlashMQ behind a firewall or VPN that restricts access to known client subnets
Configure the service manager to automatically restart FlashMQ on abort to reduce outage duration until patching completes

bash

# Verify installed FlashMQ version and upgrade
flashmq --version
# Upgrade to 1.26.2 or later using your distribution package manager
# Example (Debian/Ubuntu):
sudo apt update && sudo apt install --only-upgrade flashmq
sudo systemctl restart flashmq
systemctl status flashmq