CVE-2026-46411

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46411", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-13T21:04:10.933Z", "datePublished": "2026-06-09T23:01:33.212Z", "dateUpdated": "2026-06-10T14:30:30.247Z"}, "containers": {"cna": {"title": "FlashMQ: Client can trigger uncaught exception on FlashMQ 1.26.1 and older", "problemTypes": [{"descriptions": [{"cweId": "CWE-248", "lang": "en", "description": "CWE-248: Uncaught Exception", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/halfgaar/FlashMQ/security/advisories/GHSA-g35r-265r-rxrh", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/halfgaar/FlashMQ/security/advisories/GHSA-g35r-265r-rxrh"}, {"name": "https://github.com/halfgaar/FlashMQ/commit/29e08f7b97b6e3f96db923c2b6a260c47b49c195", "tags": ["x_refsource_MISC"], "url": "https://github.com/halfgaar/FlashMQ/commit/29e08f7b97b6e3f96db923c2b6a260c47b49c195"}, {"name": "https://github.com/halfgaar/FlashMQ/releases/tag/v1.26.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/halfgaar/FlashMQ/releases/tag/v1.26.2"}], "affected": [{"vendor": "halfgaar", "product": "FlashMQ", "versions": [{"version": "< 1.26.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-09T23:01:33.212Z"}, "descriptions": [{"lang": "en", "value": "FlashMQ is a MQTT broker/server, designed for multi-CPU environments. Prior to version 1.26.2, authorized clients have the ability to exceed the permitted over-commit of their write buffer and triggering an internal safe-guard exception. This exception was in a path that was not catchable, and therefore causes a server abort. This issue has been patched in version 1.26.2."}], "source": {"advisory": "GHSA-g35r-265r-rxrh", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-10T14:30:14.609160Z", "id": "CVE-2026-46411", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-10T14:30:30.247Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-46411", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-10T14:30:14.609160Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-10T14:30:20.373Z"}}], "cna": {"title": "FlashMQ: Client can trigger uncaught exception on FlashMQ 1.26.1 and older", "source": {"advisory": "GHSA-g35r-265r-rxrh", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "halfgaar", "product": "FlashMQ", "versions": [{"status": "affected", "version": "< 1.26.2"}]}], "references": [{"url": "https://github.com/halfgaar/FlashMQ/security/advisories/GHSA-g35r-265r-rxrh", "name": "https://github.com/halfgaar/FlashMQ/security/advisories/GHSA-g35r-265r-rxrh", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/halfgaar/FlashMQ/commit/29e08f7b97b6e3f96db923c2b6a260c47b49c195", "name": "https://github.com/halfgaar/FlashMQ/commit/29e08f7b97b6e3f96db923c2b6a260c47b49c195", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/halfgaar/FlashMQ/releases/tag/v1.26.2", "name": "https://github.com/halfgaar/FlashMQ/releases/tag/v1.26.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "FlashMQ is a MQTT broker/server, designed for multi-CPU environments. Prior to version 1.26.2, authorized clients have the ability to exceed the permitted over-commit of their write buffer and triggering an internal safe-guard exception. This exception was in a path that was not catchable, and therefore causes a server abort. This issue has been patched in version 1.26.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-248", "description": "CWE-248: Uncaught Exception"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-09T23:01:33.212Z"}}}, "cveMetadata": {"cveId": "CVE-2026-46411", "state": "PUBLISHED", "dateUpdated": "2026-06-10T14:30:30.247Z", "dateReserved": "2026-05-13T21:04:10.933Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-09T23:01:33.212Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "FlashMQ", "vendor": "halfgaar", "versions": [{"status": "affected", "version": "< 1.26.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "FlashMQ is a MQTT broker/server, designed for multi-CPU environments. Prior to version 1.26.2, authorized clients have the ability to exceed the permitted over-commit of their write buffer and triggering an internal safe-guard exception. This exception was in a path that was not catchable, and therefore causes a server abort. This issue has been patched in version 1.26.2."}, {"lang": "es", "value": "FlashMQ es un broker/servidor MQTT, dise\u00f1ado para entornos multi-CPU. Antes de la versi\u00f3n 1.26.2, los clientes autorizados tienen la capacidad de exceder el sobrecompromiso permitido de su b\u00fafer de escritura y desencadenar una excepci\u00f3n de salvaguarda interna. Esta excepci\u00f3n estaba en una ruta que no era capturable y, por lo tanto, causa un aborto del servidor. Este problema ha sido parcheado en la versi\u00f3n 1.26.2."}], "id": "CVE-2026-46411", "lastModified": "2026-07-23T09:10:00.113", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46411", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-10T14:30:14.609160Z", "version": "2.0.3"}}]}, "published": "2026-06-10T00:16:53.407", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/halfgaar/FlashMQ/commit/29e08f7b97b6e3f96db923c2b6a260c47b49c195"}, {"source": "security-advisories@github.com", "url": "https://github.com/halfgaar/FlashMQ/releases/tag/v1.26.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/halfgaar/FlashMQ/security/advisories/GHSA-g35r-265r-rxrh"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-248"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.26.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "FlashMQ", "source": "cna", "vendor": "halfgaar"}, "product": "flashmq", "vendor": "halfgaar"}], "created": "2026-06-10T01:00:12.979179+00:00", "updated": "2026-06-10T02:15:19.177932+00:00", "vendors": ["halfgaar", "halfgaar$PRODUCT$flashmq"]}