CVE-2026-8741

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-8741

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-8741.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-8741

Published

2026-05-17T08:15:08.625Z

Modified

2026-07-15T01:49:06.409477604Z

Severity

1.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

EMQX QoS 2 PUBLISH Packet emqx_persistent_session_ds.erl race condition

Details

A vulnerability has been found in EMQX up to 6.2.0. This affects an unknown function of the file apps/emqx/src/emqxpersistentsession_ds.erl of the component QoS 2 PUBLISH Packet Handler. Such manipulation leads to race condition. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is reported as difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

Database specific

{
    "cwe_ids": [
        "CWE-362"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8741.json",
    "cna_assigner": "VulDB",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "6.0"
                },
                {
                    "last_affected": "6.0"
                },
                {
                    "introduced": "6.1"
                },
                {
                    "last_affected": "6.1"
                },
                {
                    "introduced": "6.2.0"
                },
                {
                    "last_affected": "6.2.0"
                }
            ]
        }
    ]
}

References

Affected packages

Git / github.com/emqx/emqx

Affected ranges

Type

GIT

Repo

https://github.com/emqx/emqx

Events

Introduced

3ccb4ec2da86efe6ea0110fdb89bcafa62276aae

Last affected

5f205e1b301d7aee80e72c1c4d44e71f2a4793d6

Database specific

{
    "cpe": "cpe:2.3:a:emqx:emqx:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "5.0.0"
        },
        {
            "last_affected": "6.2.0"
        }
    ]
}

Affected versions

6.*

6.1.0

6.1.0-alpha.2

6.1.0-rc.1

6.2.0

6.2.0-alpha.1

6.2.0-rc.1

e5.*

e5.0.0-beta.6

e6.*

e6.1.0-alpha.1

v5.*

v5.0.0

v5.0.1

v5.0.1-beta.1

v5.0.10

v5.0.2

v5.0.3

v5.0.5-beta.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-8741.json"