FlashMQ is a MQTT broker/server, designed for multi-CPU environments. Prior to version 1.26.1, a remote client with retained publish permission can crash the FlashMQ broker when both set_retained_message_defer_timeout and set_retained_message_defer_timeout_spread are configured to non-default values, resulting in denial of service. If anonymous retained publishing is allowed, no authentication is required; otherwise, the attacker needs the corresponding publish permission. This issue has been patched in version 1.26.1.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
| Vendors | Products |
|---|
References
History
Fri, 08 May 2026 22:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | FlashMQ is a MQTT broker/server, designed for multi-CPU environments. Prior to version 1.26.1, a remote client with retained publish permission can crash the FlashMQ broker when both set_retained_message_defer_timeout and set_retained_message_defer_timeout_spread are configured to non-default values, resulting in denial of service. If anonymous retained publishing is allowed, no authentication is required; otherwise, the attacker needs the corresponding publish permission. This issue has been patched in version 1.26.1. | |
| Title | FlashMQ: Division by zero crash when using non-default deferred retained message setting | |
| Weaknesses | CWE-369 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-05-08T21:40:43.284Z
Reserved: 2026-04-25T05:04:37.028Z
Link: CVE-2026-42209
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-05-08T22:16:32.103
Modified: 2026-05-08T22:16:32.103
Link: CVE-2026-42209
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-05-08T23:30:15Z