Executive brief
FlashMQ is a high-performance message broker used to route data between devices in multi-CPU environments. A vulnerability allows a logged-in user to crash the server by flooding it with specific types of network traffic that exceed internal memory limits. This results in a complete service outage, preventing all connected devices from communicating until the server is manually restarted.
Technical details
A denial-of-service vulnerability exists in FlashMQ due to an uncaught exception (CWE-248) when handling write buffer over-commits. An authenticated attacker can flood the server with control packets (such as QoS packets they are not authorized for) without draining their own buffer. This causes the internal circular buffer to exceed its 2 GB limit, triggering a safeguard exception within the AckSender destructor. Because the exception occurs in a code path where it cannot be caught, the process aborts. The issue is fixed in version 1.26.2 by enforcing explicit limits on buffer over-pressure.
Affected products
- halfgaar FlashMQ < 1.26.2
Timeline
- 2026-05-14: patched: Version 1.26.2 released
- 2026-05-14: advisory: GitHub Security Advisory GHSA-g35r-265r-rxrh published
- 2026-06-10: disclosed: CVE-2026-46411 published to NVD