EUVD-2026-17195Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to version 0.24.8, NanoMQ’s MQTT-over-WebSocket transport can be crashed by sending an MQTT packet with a deliberately large Remaining Length in the fixed header while providing a much shorter actual payload. The code path copies Remaining Length bytes without verifying that the current receive buffer contains that many bytes, resulting in an out-of-bounds read (ASAN reports OOB / crash). This is remotely triggerable over the WebSocket listener. This issue has been patched in version 0.24.8.
AnalysisAI
NanoMQ MQTT Broker versions prior to 0.24.8 can be remotely crashed via MQTT-over-WebSocket by sending a packet with a maliciously inflated Remaining Length field in the fixed header while providing a shorter actual payload, triggering an out-of-bounds read that causes denial of service. Authenticated attackers can exploit this condition over the WebSocket listener with low attack complexity. Vendor-released patch available in version 0.24.8.
Technical ContextAI
The vulnerability exists in NanoMQ's MQTT-over-WebSocket transport layer implementation. MQTT packets include a Remaining Length field in the fixed header that indicates the size of the variable header and payload. The affected code path attempts to copy the number of bytes specified by Remaining Length directly from the receive buffer without first validating that sufficient bytes are actually present in the current buffer state. This results in CWE-125 (Out-of-bounds Read), where the memory access operation reads beyond allocated buffer boundaries. The MQTT protocol uses variable-length encoding for the Remaining Length field, but improper bounds checking during buffer consumption in the WebSocket handler allows an attacker to craft a malformed packet that causes ASAN (AddressSanitizer) to detect and report the out-of-bounds condition, leading to broker crash. The CPE cpe:2.3:a:nanomq:nanomq:*:*:*:*:*:*:*:* indicates all NanoMQ versions are affected up to and excluding 0.24.8.
RemediationAI
Vendor-released patch available: Upgrade NanoMQ to version 0.24.8 or later immediately. The underlying fix was merged via upstream commit e80b30bad6d855593a68d18f2785bfaca6faf09e (https://github.com/nanomq/NanoNNG/commit/e80b30bad6d855593a68d18f2785bfaca6faf09e) and is also available in pull request PR/1405 (https://github.com/nanomq/NanoNNG/pull/1405). During the patching window, operators should restrict access to the MQTT-over-WebSocket listener to trusted networks if possible, implement network-level rate limiting on WebSocket connections to mitigate rapid repeated exploitation attempts, and monitor broker logs for unexpected crashes or ASAN reports. Organizations unable to immediately upgrade should prioritize patching given the remote accessibility and low complexity of exploitation.
NanoMQ 0.17.5 has a one-byte heap-based buffer over-read in the conn_handler function of mqtt_parser.c when it processes
CVE-2024-42646 is a segmentation fault vulnerability in NanoMQ v0.21.10 that allows unauthenticated remote attackers to
Null Pointer Dereference vulnerability in topic_filtern function in mqtt_parser.c in NanoMQ 0.21.7 allows attackers to c
A use-after-free vulnerability exists in NanoMQ 0.17.2. Rated high severity (CVSS 7.5), this vulnerability is remotely e
A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. Rated high severity (CVSS 7.5), this vulnerability is remo
A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. Rated high severity (CVSS 7.5), this vulnerability is remo
A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. Rated high severity (CVSS 7.5), this vulnerability is remo
In NanoMQ v0.15.0-0, segment fault with Null Pointer Dereference occurs in the process of decoding subinfo_decode and un
In NanoMQ v0.15.0-0, a Heap overflow occurs in copyn_utf8_str function of mqtt_parser.c. Rated high severity (CVSS 7.5),
In NanoMQ v0.15.0-0, Heap overflow occurs in read_byte function of mqtt_code.c. Rated high severity (CVSS 7.5), this vul
A heap-buffer-overflow vulnerability in the read_byte function in NanoMQ v.0.21.7 allows attackers to cause a denial of
NanoMQ v0.22.10 was discovered to contain a memory leak which allows attackers to cause a Denial of Service (DoS) via a
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today