What is the CVSS score of CVE-2026-35217?

CVE-2026-35217 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.2%.

NanoMQ CVE-2026-35217

EUVD-2026-46021 MEDIUM

Out-of-bounds Read (CWE-125)

2026-07-20 GitHub_M

Buffer Overflow Information Disclosure Nanomq

6.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.5 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

vuln.today AI

6.5 MEDIUM

Network-reachable and unauthenticated (AV:N/PR:N), but AC:H because the crash path requires precise packet-length alignment; C:N since the 1-byte OOB read is not returned to the attacker.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 18:27 vuln.today

DescriptionCVE.org

NanoMQ contains a protocol-semantics flaw in its MQTT v5 SUBSCRIBE handling: if a subscription entry is missing the final 1-byte Subscription Options field, the broker may still accept the malformed packet and install the subscription into internal broker state. Under a specific packet-length construction, the same parser flaw also causes a 1-byte out-of-bounds read that crosses the real heap allocation boundary and is detected by ASAN as a heap-buffer-overflow.

If the consumed byte happens to look acceptable, NanoMQ may continue and append the malformed subscription entry into its internal subinfol state. In that case, a SUBSCRIBE packet that should be rejected by MQTT rules is instead treated as a successful subscription. Whether ASAN reports the bug does not depend on MQTT's logical remain boundary; it depends on whether the read crosses the real heap allocation boundary of the underlying message buffer. In other words, these are not two unrelated issues. They are two manifestations of the same parsing defect: by default, it appears as a semantic vulnerability, and under suitable input conditions, it also becomes a verifiable out-of-bounds read vulnerability.

AnalysisAI

NanoMQ's MQTT v5 SUBSCRIBE packet parser fails to enforce the mandatory 1-byte Subscription Options field, enabling remote unauthenticated attackers to submit malformed SUBSCRIBE packets that the broker silently accepts and installs into internal subscription state. Under a precisely crafted packet-length condition, the same defect manifests as a 1-byte heap-buffer-overflow (CWE-125), confirmed by ASAN, which can crash the broker and disrupt all connected MQTT clients. All NanoMQ releases up to and including 0.24.14 are affected; no confirmed active exploitation (KEV) or public exploit code has been identified at time of analysis, though the unauthenticated network attack surface warrants prompt remediation in internet-exposed deployments.

Technical ContextAI

NanoMQ is a lightweight, embeddable MQTT broker designed for IoT and edge computing use cases (CPE: cpe:2.3:a:nanomq:nanomq:*:*:*:*:*:*:*:*). The vulnerability resides in the MQTT v5 protocol parser's SUBSCRIBE packet handler. In MQTT v5, each subscription entry within a SUBSCRIBE packet must terminate with exactly one Subscription Options byte encoding flags for QoS, No-Local, Retain-As-Published, and Retain-Handling. The NanoMQ parser does not validate the presence of this byte before attempting to read it; it consumes the byte unconditionally regardless of the packet's remaining-length boundary. CWE-125 (Out-of-bounds Read) characterizes the root cause: when the absent Subscription Options byte falls at the exact boundary of the underlying heap-allocated message buffer, the read crosses the real allocation boundary - a condition ASAN detects as a heap-buffer-overflow. When the out-of-bounds read does not cross the allocator boundary (the more common semantic path), the garbage byte is interpreted as a valid Subscription Options value and the malformed subscription entry is installed into the broker's internal subinfol subscription state, creating an integrity anomaly without a crash. Both effects are manifestations of the same missing-field validation defect.

RemediationAI

Upgrade NanoMQ to a version beyond 0.24.14 as the primary fix. The exact patched release version is not independently confirmed from the available input data - consult the GitHub Security Advisory GHSA-w4xh-p384-w556 at https://github.com/nanomq/nanomq/security/advisories/GHSA-w4xh-p384-w556 to confirm the specific fixed release before upgrading. If immediate upgrade is not feasible, apply network-level restrictions to the MQTT listener ports (typically TCP 1883 for plaintext, TCP 8883 for TLS) using firewall rules, VPC security groups, or host-based access controls to permit only trusted, known MQTT clients - this reduces exposure to unauthenticated remote attackers but does not eliminate the vulnerability if a compromised or malicious client exists within the allowed network segment. Note that MQTT-level authentication (username/password or mutual TLS) does not prevent exploitation since the CVSS vector is PR:N, meaning the parser flaw is triggered before or independent of authentication state in the SUBSCRIBE processing path.