EUVD-2026-23939Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
7DescriptionGitHub Advisory
NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Versions prior to 0.24.11 have a remotely triggerable heap buffer overflow in the uri_param_parse function of NanoMQ's REST API. The vulnerability occurs due to an off-by-one error when allocating memory for query parameter keys and values, allowing an attacker to write a null byte beyond the allocated buffer. This can be triggered via a crafted HTTP request. Version 0.24.11 patches the issue.
AnalysisAI
Heap buffer overflow in NanoMQ MQTT Broker's REST API allows remote unauthenticated attackers to trigger denial of service via crafted HTTP requests. The off-by-one error in uri_param_parse function (CWE-122) affects all versions prior to 0.24.11. CVSS 7.7 (High) with network attack vector, low complexity, and no authentication required. Proof-of-concept exploit exists (CVSS E:P), though no CISA KEV listing indicates limited observed exploitation. Vendor patch available in version 0.24.11 with upstream fix committed (GitHub 69a97b3).
Technical ContextAI
NanoMQ is a lightweight MQTT broker designed for edge computing environments, providing messaging infrastructure with REST API endpoints. The vulnerability resides in the uri_param_parse function responsible for parsing HTTP query parameters in the REST API component. The root cause is an off-by-one error (CWE-122: Heap-based Buffer Overflow) during memory allocation for query parameter keys and values. When processing HTTP requests, the parser allocates a buffer but fails to account for the null terminator byte, allowing a single null byte write beyond the allocated heap memory boundary. This classic off-by-one vulnerability can corrupt adjacent heap metadata or data structures, potentially causing application crashes. The affected CPE (cpe:2.3:a:nanomq:nanomq) confirms impact across the NanoMQ product line, with the REST API being the attack surface exposed to network requests.
RemediationAI
Upgrade NanoMQ MQTT Broker to version 0.24.11 or later, which contains the vendor-released patch addressing the off-by-one heap overflow (commit 69a97b3b39cc218f044f1c8896f4d3d8757bb394 available at https://github.com/nanomq/nanomq/commit/69a97b3b39cc218f044f1c8896f4d3d8757bb394). For systems unable to immediately upgrade, implement network-level access controls to restrict REST API exposure: bind the REST API to localhost/management networks only, deploy reverse proxy with request filtering to block malformed query parameters, or disable the REST API entirely if not operationally required (trade-off: loss of HTTP-based management/monitoring capabilities). Apply rate limiting and connection throttling on REST API endpoints to mitigate denial-of-service impact if exploitation occurs. Monitor NanoMQ process crashes and HTTP 5xx errors as potential indicators of exploitation attempts. Full remediation details in GitHub advisory GHSA-6w96-9qw7-m599.
NanoMQ 0.17.5 has a one-byte heap-based buffer over-read in the conn_handler function of mqtt_parser.c when it processes
CVE-2024-42646 is a segmentation fault vulnerability in NanoMQ v0.21.10 that allows unauthenticated remote attackers to
Null Pointer Dereference vulnerability in topic_filtern function in mqtt_parser.c in NanoMQ 0.21.7 allows attackers to c
A use-after-free vulnerability exists in NanoMQ 0.17.2. Rated high severity (CVSS 7.5), this vulnerability is remotely e
A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. Rated high severity (CVSS 7.5), this vulnerability is remo
A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. Rated high severity (CVSS 7.5), this vulnerability is remo
A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. Rated high severity (CVSS 7.5), this vulnerability is remo
In NanoMQ v0.15.0-0, segment fault with Null Pointer Dereference occurs in the process of decoding subinfo_decode and un
In NanoMQ v0.15.0-0, a Heap overflow occurs in copyn_utf8_str function of mqtt_parser.c. Rated high severity (CVSS 7.5),
In NanoMQ v0.15.0-0, Heap overflow occurs in read_byte function of mqtt_code.c. Rated high severity (CVSS 7.5), this vul
A heap-buffer-overflow vulnerability in the read_byte function in NanoMQ v.0.21.7 allows attackers to cause a denial of
NanoMQ v0.22.10 was discovered to contain a memory leak which allows attackers to cause a Denial of Service (DoS) via a
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Heap Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today