CVE-2026-47276
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in `properties_parse()` allows an authenticated attacker to crash the NanoMQ broker by sending a POST request to `/api/v4/mqtt/publish` with `user_properties` as a JSON array instead of a JSON object. The crash occurs because `strlen()` is called on a NULL `item->string` pointer when iterating over array elements.
Risk Assessment
The risk is that an authenticated attacker can remotely crash the NanoMQ broker, causing a denial of service.
Recommendation
It is recommended to upgrade NanoMQ to version 0.24.14 or later.
Other vulnerabilities in NanoMQ
See all- CVE-2025-59947Critical
NanoMQ before version 0.24.4 has a buffer overflow vulnerability when PUBLISH packets trigger both shared and vanilla subscriptions. This is fixed in version 0.24.4.
- CVE-2026-47275Low
In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in nni_mqttv5_msg_decode_connect allows a malicious MQTT broker to crash any connecting NanoMQ MQTTv5 client (including bridge mode) with a single packet, causing remote denial of service via SIGSEGV. The issue occurs because the code uses variable 'prop' instead of 'will_prop' when iterating over CONNECT properties.
- CVE-2026-35217Medium
NanoMQ contains a protocol-semantics flaw in its MQTT v5 SUBSCRIBE handling. If a subscription entry is missing the final 1-byte Subscription Options field, the broker may accept the malformed packet and install the subscription. Under specific conditions, the same parser flaw also causes a 1-byte out-of-bounds read detected by ASAN as a heap-buffer-overflow.
- CVE-2026-36590High
A vulnerability in NanoMQ version 0.24.9 allows a remote attacker to cause a denial of service (DoS) via the nni_qos_db_set function in the broker_tcp.c component.
- CVE-2026-45151Low
In NanoMQ MQTT Broker version 0.24.8 and earlier, quic_stream_recv can dereference a null substream pointer when a substream is in reopen state. The code finishes the AIO with error but does not return before locking c->mtx, potentially leading to crashes or other issues.
- CVE-2026-44640Medium
NanoMQ MQTT Broker before version 0.24.14 has a type confusion vulnerability during dialer close. This leads to incorrect object interpretation and may cause hang or crash.
- CVE-2026-32134Medium
NULL pointer dereference vulnerability in NanoMQ MQTT Broker versions 0.24.10 and below during high-concurrency reconnect traffic. Causes broker crash (DoS) without authentication. Fixed in version 0.24.11.
- CVE-2026-34608Medium
NanoMQ before version 0.24.10 has an out-of-bounds read vulnerability in the hook_work_cb() function in webhook_inproc.c. The cJSON_Parse function reads data from a buffer without a guaranteed null terminator, potentially accessing memory beyond the allocated buffer.
- CVE-2023-34494High
NanoMQ version 0.16.5 is vulnerable to heap-use-after-free in the nano_ctx_send function of nmq_mqtt.c.
- CVE-2023-34488High
NanoMQ version 0.17.5 has a heap-based buffer over-read in the conn_handler function of mqtt_parser.c when processing malformed messages.
Original NVD description (English source)
In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in `properties_parse()` allows an authenticated attacker to crash the NanoMQ broker by sending a POST request to `/api/v4/mqtt/publish` with `user_properties` as a JSON array instead of a JSON object. The crash occurs because `strlen()` is called on a NULL `item->string` pointer when iterating over array elements. An authenticated attacker can exploit this to crash the NanoMQ broker process. This is patched in version 0.24.14.