What is the CVSS score of CVE-2026-21888?

CVE-2026-21888 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Nanomq are affected by CVE-2026-21888?

NanoMQ MQTT Broker deployments are vulnerable to denial-of-service attacks through malformed MQTT v5 messages that trigger out-of-bounds memory reads and application crashes.

How to fix or mitigate CVE-2026-21888?

Within 24 hours: Inventory all NanoMQ deployments and assess exposure in production environments. Within 7 days: Implement network segmentation to restrict MQTT broker access to trusted clients only, and disable MQTT v5 support if MQTT v3.1.1 is sufficient for operations. Within 30 days: Establish monitoring for abnormal MQTT connection patterns and malformed packets; contact NanoMQ vendor for patch timeline and evaluate alternative MQTT brokers if patch availability remains uncertain.

Nanomq CVE-2026-21888

HIGH

Out-of-bounds Read (CWE-125)

2026-03-11 security-advisories@github.com

Buffer Overflow Information Disclosure Nanomq Emqx

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 11, 2026 - 16:16 nvd

HIGH 7.5

DescriptionGitHub Advisory

NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. MQTT v5 Variable Byte Integer parsing out-of-bounds: get_var_integer() accepts 5-byte varints without bounds checks; reliably triggers OOB read / crash when built with ASan. This affects 0.24.6 and earlier.

AnalysisAI

NanoMQ MQTT Broker versions 0.24.6 and earlier are vulnerable to an out-of-bounds read in the MQTT v5 Variable Byte Integer parser, which lacks proper bounds validation when processing 5-byte varints. Remote unauthenticated attackers can trigger a denial of service by sending malformed MQTT packets that crash the broker. No patch is currently available for this vulnerability.

Technical ContextAI

Classified as CWE-125 (Out-of-bounds Read). NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. MQTT v5 Variable Byte Integer parsing out-of-bounds: get_var_integer() accepts 5-byte varints without bounds checks; reliably triggers OOB read / crash when built with ASan. This affects 0.24.6 and earlier.