Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
FlashMQ is a MQTT broker/server, designed for multi-CPU environments. Prior to version 1.26.1, a remote client with retained publish permission can crash the FlashMQ broker when both set_retained_message_defer_timeout and set_retained_message_defer_timeout_spread are configured to non-default values, resulting in denial of service. If anonymous retained publishing is allowed, no authentication is required; otherwise, the attacker needs the corresponding publish permission. This issue has been patched in version 1.26.1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-42209 FlashMQ is a MQTT broker/server, designed for multi-CPU environments. Prior to version 1.26.1, a remote client with retained publish permission can crash the FlashMQ … https://www.cve.org/CVERecord?id=CVE-2026-42209
Post summary
FlashMQ MQTT broker suffers a crash vulnerability (CVE‑2026‑42209) in versions before 1.26.1 when a remote client with retained publish permission interacts; no PoC, exploit, or patch is disclosed.
CVE-2026-42209 Denial of Service in FlashMQ Broker Prior to Version 1.26.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42209
Post summary
The text reports a Denial of Service vulnerability (CVE-2026-42209) in FlashMQ Broker versions before 1.26.1, but provides no evidence of exploitation, fixes, or PoC details.