CVE-2026-35217
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
NanoMQ contains a protocol-semantics flaw in its MQTT v5 SUBSCRIBE handling. If a subscription entry is missing the final 1-byte Subscription Options field, the broker may accept the malformed packet and install the subscription. Under specific conditions, the same parser flaw also causes a 1-byte out-of-bounds read detected by ASAN as a heap-buffer-overflow.
Risk Assessment
An attacker can send a SUBSCRIBE packet that should be rejected but is treated as a successful subscription. Under suitable conditions, this can also lead to an out-of-bounds memory read, potentially exposing sensitive data.
Recommendation
Upgrade NanoMQ to the latest patched version.
Other vulnerabilities in NanoMQ
See all- CVE-2025-59947Critical
NanoMQ before version 0.24.4 has a buffer overflow vulnerability when PUBLISH packets trigger both shared and vanilla subscriptions. This is fixed in version 0.24.4.
- CVE-2026-47276Medium
In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in `properties_parse()` allows an authenticated attacker to crash the NanoMQ broker by sending a POST request to `/api/v4/mqtt/publish` with `user_properties` as a JSON array instead of a JSON object. The crash occurs because `strlen()` is called on a NULL `item->string` pointer when iterating over array elements.
- CVE-2026-47275Low
In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in nni_mqttv5_msg_decode_connect allows a malicious MQTT broker to crash any connecting NanoMQ MQTTv5 client (including bridge mode) with a single packet, causing remote denial of service via SIGSEGV. The issue occurs because the code uses variable 'prop' instead of 'will_prop' when iterating over CONNECT properties.
- CVE-2026-36590High
A vulnerability in NanoMQ version 0.24.9 allows a remote attacker to cause a denial of service (DoS) via the nni_qos_db_set function in the broker_tcp.c component.
- CVE-2026-45151Low
In NanoMQ MQTT Broker version 0.24.8 and earlier, quic_stream_recv can dereference a null substream pointer when a substream is in reopen state. The code finishes the AIO with error but does not return before locking c->mtx, potentially leading to crashes or other issues.
- CVE-2026-44640Medium
NanoMQ MQTT Broker before version 0.24.14 has a type confusion vulnerability during dialer close. This leads to incorrect object interpretation and may cause hang or crash.
- CVE-2026-32134Medium
NULL pointer dereference vulnerability in NanoMQ MQTT Broker versions 0.24.10 and below during high-concurrency reconnect traffic. Causes broker crash (DoS) without authentication. Fixed in version 0.24.11.
- CVE-2026-34608Medium
NanoMQ before version 0.24.10 has an out-of-bounds read vulnerability in the hook_work_cb() function in webhook_inproc.c. The cJSON_Parse function reads data from a buffer without a guaranteed null terminator, potentially accessing memory beyond the allocated buffer.
- CVE-2023-34494High
NanoMQ version 0.16.5 is vulnerable to heap-use-after-free in the nano_ctx_send function of nmq_mqtt.c.
- CVE-2023-34488High
NanoMQ version 0.17.5 has a heap-based buffer over-read in the conn_handler function of mqtt_parser.c when processing malformed messages.
Original NVD description (English source)
NanoMQ contains a protocol-semantics flaw in its MQTT v5 `SUBSCRIBE` handling: if a subscription entry is missing the final 1-byte `Subscription Options` field, the broker may still accept the malformed packet and install the subscription into internal broker state. Under a specific packet-length construction, the same parser flaw also causes a 1-byte out-of-bounds read that crosses the real heap allocation boundary and is detected by ASAN as a `heap-buffer-overflow`. If the consumed byte happens to look acceptable, NanoMQ may continue and append the malformed subscription entry into its internal `subinfol` state. In that case, a `SUBSCRIBE` packet that should be rejected by MQTT rules is instead treated as a successful subscription. Whether ASAN reports the bug does not depend on MQTT's logical `remain` boundary; it depends on whether the read crosses the real heap allocation boundary of the underlying message buffer. In other words, these are not two unrelated issues. They are two manifestations of the same parsing defect: by default, it appears as a semantic vulnerability, and under suitable input conditions, it also becomes a verifiable out-of-bounds read vulnerability.