EUVD-2026-33429Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In 0.24.8 and earlier, quic_stream_recv can dereference a null substream pointer when a substream is in reopen state. The code finishes the AIO with error but does not return before locking c->mtx.
AnalysisAI
Null pointer dereference in NanoMQ MQTT Broker 0.24.8 and earlier causes a denial-of-service condition via the QUIC transport layer. The function quic_stream_recv fails to return after completing an asynchronous I/O operation with an error when a substream is in reopen state, proceeding to lock c->mtx against a null substream pointer. An unauthenticated remote attacker can crash the broker process, disrupting edge messaging services. No public exploit identified at time of analysis beyond proof-of-concept code reflected in the CVSS 4.0 E:P metric; not listed in CISA KEV.
Technical ContextAI
NanoMQ is an edge MQTT broker implementing the QUIC transport protocol (MQTT-over-QUIC) for low-latency IoT messaging. The vulnerability resides in quic_stream_recv, the receive handler for QUIC stream objects. CWE-476 (NULL Pointer Dereference) describes the root cause: when a QUIC substream transitions to a 'reopen' state, the substream pointer can be null at the point where quic_stream_recv attempts to acquire the connection mutex c->mtx. The code path correctly finishes the asynchronous I/O (AIO) with an error code but omits a guard return before the subsequent mutex lock, meaning execution proceeds to dereference the null pointer. This is a classic CWE-476 pattern - error-path code that partially handles the error condition but fails to fully abort execution. Affected CPE: cpe:2.3:a:nanomq:nanomq:*:*:*:*:*:*:*:* for all versions through 0.24.8.
RemediationAI
The primary remediation is to upgrade NanoMQ to a version beyond 0.24.8 that addresses this null pointer dereference; the exact patched release version should be confirmed via the vendor advisory at https://github.com/nanomq/nanomq/security/advisories/GHSA-9qhf-wgp4-p7w5, as the upstream fix version was not independently confirmed in the available intelligence. For deployments unable to upgrade immediately, a viable compensating control is to disable MQTT-over-QUIC transport and fall back to TCP-based MQTT connections, which removes the vulnerable quic_stream_recv code path entirely; the trade-off is loss of QUIC's low-latency characteristics for constrained edge devices. Alternatively, restricting QUIC port access (typically UDP 14567 or the configured QUIC listener port) to trusted IP ranges via firewall policy limits exposure to the network attack vector while preserving QUIC functionality for authorized clients. Process-level mitigations such as configuring a supervisor (systemd, supervisord) to automatically restart the broker on crash can reduce downtime if patching is delayed, though this does not prevent the crash itself.
NanoMQ 0.17.5 has a one-byte heap-based buffer over-read in the conn_handler function of mqtt_parser.c when it processes
CVE-2024-42646 is a segmentation fault vulnerability in NanoMQ v0.21.10 that allows unauthenticated remote attackers to
Null Pointer Dereference vulnerability in topic_filtern function in mqtt_parser.c in NanoMQ 0.21.7 allows attackers to c
A use-after-free vulnerability exists in NanoMQ 0.17.2. Rated high severity (CVSS 7.5), this vulnerability is remotely e
A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. Rated high severity (CVSS 7.5), this vulnerability is remo
A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. Rated high severity (CVSS 7.5), this vulnerability is remo
A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. Rated high severity (CVSS 7.5), this vulnerability is remo
In NanoMQ v0.15.0-0, segment fault with Null Pointer Dereference occurs in the process of decoding subinfo_decode and un
In NanoMQ v0.15.0-0, a Heap overflow occurs in copyn_utf8_str function of mqtt_parser.c. Rated high severity (CVSS 7.5),
In NanoMQ v0.15.0-0, Heap overflow occurs in read_byte function of mqtt_code.c. Rated high severity (CVSS 7.5), this vul
A heap-buffer-overflow vulnerability in the read_byte function in NanoMQ v.0.21.7 allows attackers to cause a denial of
NanoMQ v0.22.10 was discovered to contain a memory leak which allows attackers to cause a Denial of Service (DoS) via a
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today