CVE-2026-115417 - Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt
CVE-2026-115417
Summary
Bulletin ID: 2026-146-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 10/22/2026 13:00 PM PDT
Description:
Strands Agents is an open-source SDK, available for Python and TypeScript, for building AI agents. The SDK includes an Agent2Agent (A2A) server component that exposes an agent over HTTP so other agents and clients can call it. We identified CVE-2026-115419, an issue where the A2A server did not properly isolate conversation state between callers.
An authenticated remote user could access another caller's conversation history or influence model behavior for other callers in multi-tenant deployments.
Impacted versions:
- strands-agents (Python): all versions containing the multiagent.a2a module, < 1.43.0
- @strands-agents/sdk (TypeScript): < 1.5.0
Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Read this article
Products covered
A separate affected-products list was not included in the collected bulletin.
Remediation
Separate remediation guidance was not included in the collected bulletin.
CVEs in this advisory 1
Updates
- Published by AWS
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.