EUVD-2026-33428Severity by source
AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to 0.24.14, aio->prov_data is stored as nni_quic_conn* during dialing, but read as ex_quic_conn* during dialer close. This type confusion causes invalid object interpretation and leads to close-path hang/crash behavior. This vulnerability is fixed in 0.24.14.
AnalysisAI
Type confusion in NanoMQ MQTT Broker's QUIC dialer close path allows a local attacker with high complexity to cause the broker process to hang or crash. Versions prior to 0.24.14 store a pointer as nni_quic_conn* during dialing but later misread that same memory location as ex_quic_conn* during dialer close, producing invalid object interpretation across mismatched struct layouts. No public exploit code or active exploitation has been identified at time of analysis; the vendor-released fix is available in version 0.24.14.
Technical ContextAI
NanoMQ is an edge-optimized MQTT broker that supports QUIC as a transport protocol. The vulnerable component is the QUIC dialer's asynchronous I/O abstraction, specifically the aio->prov_data field - a generic provider-data pointer used across different transport implementations. During the dialing phase, this field is assigned a pointer of type nni_quic_conn*. However, when the dialer close sequence executes, the same memory location is read and cast as ex_quic_conn*. Because these two struct types almost certainly differ in memory layout, field offsets, and vtable arrangements, dereferencing the mistyped pointer causes the runtime to operate on structurally incorrect memory - the precise definition of CWE-843 (Access of Resource Using Incompatible Type). The result is undefined behavior in the close path, manifesting as a hang or crash. The CPE string cpe:2.3:a:nanomq:nanomq:*:*:*:*:*:*:*:* confirms all NanoMQ releases prior to 0.24.14 carry this defect.
RemediationAI
The primary and recommended fix is to upgrade NanoMQ to version 0.24.14 or later, which corrects the type confusion in the QUIC dialer close path. The patched release is available at https://github.com/nanomq/nanomq/releases/tag/0.24.14, with the corresponding security advisory at https://github.com/nanomq/nanomq/security/advisories/GHSA-9fgw-v323-jmjj. If an immediate upgrade cannot be performed, operators should consider disabling QUIC transport in the NanoMQ configuration and restricting the broker to TCP or TLS-only listeners, which removes the vulnerable code path entirely. This workaround carries the trade-off of eliminating QUIC's multiplexing and low-latency benefits for edge clients operating over lossy or high-latency links. No other compensating controls are identified in available intelligence.
NanoMQ 0.17.5 has a one-byte heap-based buffer over-read in the conn_handler function of mqtt_parser.c when it processes
CVE-2024-42646 is a segmentation fault vulnerability in NanoMQ v0.21.10 that allows unauthenticated remote attackers to
Null Pointer Dereference vulnerability in topic_filtern function in mqtt_parser.c in NanoMQ 0.21.7 allows attackers to c
A use-after-free vulnerability exists in NanoMQ 0.17.2. Rated high severity (CVSS 7.5), this vulnerability is remotely e
A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. Rated high severity (CVSS 7.5), this vulnerability is remo
A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. Rated high severity (CVSS 7.5), this vulnerability is remo
A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. Rated high severity (CVSS 7.5), this vulnerability is remo
In NanoMQ v0.15.0-0, segment fault with Null Pointer Dereference occurs in the process of decoding subinfo_decode and un
In NanoMQ v0.15.0-0, a Heap overflow occurs in copyn_utf8_str function of mqtt_parser.c. Rated high severity (CVSS 7.5),
In NanoMQ v0.15.0-0, Heap overflow occurs in read_byte function of mqtt_code.c. Rated high severity (CVSS 7.5), this vul
A heap-buffer-overflow vulnerability in the read_byte function in NanoMQ v.0.21.7 allows attackers to cause a denial of
NanoMQ v0.22.10 was discovered to contain a memory leak which allows attackers to cause a Denial of Service (DoS) via a
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today