halfgaar FlashMQ up to 1.26.0 set_retained_message_defer_timeout divide by zero

Summaryinfo

A vulnerability classified as problematic was found in halfgaar FlashMQ up to 1.26.0. This impacts the function set_retained_message_defer_timeout. Executing a manipulation can lead to divide by zero. The identification of this vulnerability is CVE-2026-42209. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as problematic was found in halfgaar FlashMQ up to 1.26.0. This vulnerability affects the function set_retained_message_defer_timeout. The manipulation with an unknown input leads to a divide by zero vulnerability. The CWE definition for the vulnerability is CWE-369. The product divides a value by zero. As an impact it is known to affect availability. CVE summarizes:

FlashMQ is a MQTT broker/server, designed for multi-CPU environments. Prior to version 1.26.1, a remote client with retained publish permission can crash the FlashMQ broker when both set_retained_message_defer_timeout and set_retained_message_defer_timeout_spread are configured to non-default values, resulting in denial of service. If anonymous retained publishing is allowed, no authentication is required; otherwise, the attacker needs the corresponding publish permission. This issue has been patched in version 1.26.1.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-42209 since 04/25/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1499.

Upgrading to version 1.26.1 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 193b6e7767889511cfa8e933908ea5e6a1077a1f is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• halfgaar

Name

• FlashMQ

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25
• 1.26.0

License

• open-source

Website

• Product: https://github.com/halfgaar/FlashMQ/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion