CVE-2026-44639
LowCVSS 3.7Summary
NanoMQ, an MQTT broker, prior to 0.24.14 has an MQTT v5 property decoder that walks the entire linked list for each property added, resulting in O(N²) complexity. A remote unauthenticated client can send a PUBLISH or SUBSCRIBE packet with many User Properties, causing excessive CPU usage and broker unresponsiveness.
Risk Assessment
An attacker can remotely and without authentication cause a denial of service, making the MQTT broker unavailable to legitimate clients. Repeated packets can sustain the unavailability, disrupting IoT communication.
Recommendation
Update NanoMQ to version 0.24.14 or later, which fixes this vulnerability. If updating is not possible, consider restricting broker access from untrusted networks.
Other vulnerabilities in NanoMQ
See all- CVE-2026-73863High
In NanoMQ MQTT broker prior to 0.24.14, the nmq_subinfo_decode() function reuses the length variable from the outer Properties Length while parsing each subscription identifier. A remote client can send a SUBSCRIBE packet with a multi-byte Properties Length and repeated subscription identifiers, causing a read beyond the heap message buffer. The issue is fixed in version 0.24.14.
- CVE-2025-59947Critical
NanoMQ before version 0.24.4 has a buffer overflow vulnerability when PUBLISH packets trigger both shared and vanilla subscriptions. This is fixed in version 0.24.4.
- CVE-2026-61633Low
A vulnerability in NanoMQ before 0.24.14 in the client function nni_mqtt_msg_decode_unsubscribe() fails to handle a failed read while counting topics in a malformed UNSUBSCRIBE packet. This can hang a connecting MQTT 3.1.1 client, consume CPU and memory, and repeatedly deny service when auto-reconnect is enabled.
- CVE-2026-47276Medium
In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in `properties_parse()` allows an authenticated attacker to crash the NanoMQ broker by sending a POST request to `/api/v4/mqtt/publish` with `user_properties` as a JSON array instead of a JSON object. The crash occurs because `strlen()` is called on a NULL `item->string` pointer when iterating over array elements.
- CVE-2026-47275Low
In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in nni_mqttv5_msg_decode_connect allows a malicious MQTT broker to crash any connecting NanoMQ MQTTv5 client (including bridge mode) with a single packet, causing remote denial of service via SIGSEGV. The issue occurs because the code uses variable 'prop' instead of 'will_prop' when iterating over CONNECT properties.
- CVE-2026-35217Medium
NanoMQ contains a protocol-semantics flaw in its MQTT v5 SUBSCRIBE handling. If a subscription entry is missing the final 1-byte Subscription Options field, the broker may accept the malformed packet and install the subscription. Under specific conditions, the same parser flaw also causes a 1-byte out-of-bounds read detected by ASAN as a heap-buffer-overflow.
- CVE-2026-36590High
A vulnerability in NanoMQ version 0.24.9 allows a remote attacker to cause a denial of service (DoS) via the nni_qos_db_set function in the broker_tcp.c component.
- CVE-2026-45151Low
In NanoMQ MQTT Broker version 0.24.8 and earlier, quic_stream_recv can dereference a null substream pointer when a substream is in reopen state. The code finishes the AIO with error but does not return before locking c->mtx, potentially leading to crashes or other issues.
- CVE-2026-44640Medium
NanoMQ MQTT Broker before version 0.24.14 has a type confusion vulnerability during dialer close. This leads to incorrect object interpretation and may cause hang or crash.
- CVE-2026-32134Medium
NULL pointer dereference vulnerability in NanoMQ MQTT Broker versions 0.24.10 and below during high-concurrency reconnect traffic. Causes broker crash (DoS) without authentication. Fixed in version 0.24.11.
Original NVD description (English source)
NanoMQ is an MQTT broker. Prior to 0.24.14, NanoMQ's MQTT v5 property decoder in nng/src/supplemental/mqtt/mqtt_codec.c uses property_append() to walk the entire linked list for each property added by decode_buf_properties(). A remote unauthenticated client can supply a PUBLISH or SUBSCRIBE packet containing many User Properties, causing O(N²) linked-list insertion and CPU work that makes the broker unresponsive; repeated packets can sustain the denial of service. This issue is fixed in version 0.24.14.