EUVD-2026-18464Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to version 0.24.10, in NanoMQ's webhook_inproc.c, the hook_work_cb() function processes nng messages by parsing the message body with cJSON_Parse(body). The body is obtained from nng_msg_body(msg), which is a binary buffer without a guaranteed null terminator. This leads to an out-of-bounds read (OOB read) as cJSON_Parse reads until it finds a \0, potentially accessing memory beyond the allocated buffer (e.g., nng_msg metadata or adjacent heap/stack). The issue is often masked by nng's allocation padding (extra 32 bytes of zeros for non-power-of-two sizes <1024 or non-aligned). The overflow is reliably triggered when the JSON payload length is a power-of-two >=1024 (no padding added). This issue has been patched in version 0.24.10.
AnalysisAI
Out-of-bounds read in NanoMQ MQTT Broker webhook processing allows remote attackers with high privileges to trigger denial of service by sending malformed JSON payloads. Prior to version 0.24.10, the hook_work_cb() function in webhook_inproc.c passes unsanitized binary message buffers directly to cJSON_Parse(), which reads past buffer boundaries when payloads lack null terminators. The vulnerability is reliably exploitable when JSON payload length is a power-of-two >=1024 bytes, bypassing nng's allocation padding protection. No public exploit code or active exploitation has been identified.
Technical ContextAI
NanoMQ uses the nng (nanomsg-next-generation) messaging library for MQTT brokering. The vulnerability exists in the webhook module's intra-process communication handler, which receives binary messages via nng_msg and directly extracts the body using nng_msg_body(). This raw binary pointer is passed to cJSON_Parse() without ensuring null termination. While nng allocates extra padding (32 zero bytes) for non-power-of-two allocations smaller than 1024 bytes, this protection fails for power-of-two-sized payloads >=1024 bytes, which receive no padding. The cJSON library reads memory sequentially until encountering a null byte, causing it to access heap or stack memory adjacent to the message buffer. The root cause is a failure to enforce null termination between untrusted binary data and JSON parsing (CWE-125: Out-of-bounds Read).
RemediationAI
Upgrade NanoMQ to version 0.24.10 or later, which includes a patched version of webhook_inproc.c that properly null-terminates message bodies before passing them to cJSON_Parse(). The fix is confirmed via GitHub commit 9499a4b2c47998a6aadb69238c18b9e6771b1691 and the official release tag at https://github.com/nanomq/nanomq/releases/tag/0.24.10. For users unable to upgrade immediately, restrict webhook configuration capabilities to trusted administrator accounts only, and avoid configuring webhooks with JSON payloads matching power-of-two sizes >=1024 bytes. Monitor broker logs for unexpected crashes or memory access errors that may indicate exploitation attempts.
NanoMQ 0.17.5 has a one-byte heap-based buffer over-read in the conn_handler function of mqtt_parser.c when it processes
CVE-2024-42646 is a segmentation fault vulnerability in NanoMQ v0.21.10 that allows unauthenticated remote attackers to
Null Pointer Dereference vulnerability in topic_filtern function in mqtt_parser.c in NanoMQ 0.21.7 allows attackers to c
A use-after-free vulnerability exists in NanoMQ 0.17.2. Rated high severity (CVSS 7.5), this vulnerability is remotely e
A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. Rated high severity (CVSS 7.5), this vulnerability is remo
A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. Rated high severity (CVSS 7.5), this vulnerability is remo
A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. Rated high severity (CVSS 7.5), this vulnerability is remo
In NanoMQ v0.15.0-0, segment fault with Null Pointer Dereference occurs in the process of decoding subinfo_decode and un
In NanoMQ v0.15.0-0, a Heap overflow occurs in copyn_utf8_str function of mqtt_parser.c. Rated high severity (CVSS 7.5),
In NanoMQ v0.15.0-0, Heap overflow occurs in read_byte function of mqtt_code.c. Rated high severity (CVSS 7.5), this vul
A heap-buffer-overflow vulnerability in the read_byte function in NanoMQ v.0.21.7 allows attackers to cause a denial of
NanoMQ v0.22.10 was discovered to contain a memory leak which allows attackers to cause a Denial of Service (DoS) via a
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today