NanoMQ CVE-2026-47275

Exploitation requires the attacker to control or impersonate the MQTT broker to which the NanoMQ MQTTv5 client is configured to connect. The malicious broker must send a crafted MQTTv5 CONNECT packet where will properties are present (will_prop != NULL) but connect-level properties are absent (prop == NULL) - this specific property combination is the necessary and sufficient trigger for the NULL dereference in nni_mqttv5_msg_decode_connect(). Both nanomq_cli and NanoMQ bridge mode are vulnerable through the same shared receive path. Exploitation is bounded by broker-position access: the attacker must operate the target broker endpoint, execute a man-in-the-middle attack on the MQTT connection, or (requiring admin access to the victim host) reconfigure the NanoMQ client to connect to a malicious broker. No authentication on the victim NanoMQ system is required once broker positioning is achieved. Auto-reconnect configuration on the client amplifies a transient crash into indefinite service disruption.

The official CVSS 3.1 base score of 2.6 (AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L) reflects a tightly constrained attack: high complexity, low privileges required, user interaction needed, and only low availability impact. The raw score understates operational risk in bridge-mode deployments: if auto-reconnect is enabled, a single malicious broker packet triggers an infinite crash-reconnect loop, producing persistent process-level DoS with no additional attacker effort. No EPSS score was provided in the input data, so exploitation probability cannot be quantified numerically. KEV status is not confirmed - no active exploitation is cited in CISA KEV. The described 35-byte trigger payload is structurally simple, lowering practical exploitation complexity for any attacker already holding broker-position access. Confidentiality and integrity metrics are both N, confirming this is a pure availability attack with no data exposure. The primary limiting factor is broker positioning: the attacker must control or impersonate the MQTT endpoint the NanoMQ client is configured to reach, which restricts opportunistic mass exploitation.

An attacker who operates or impersonates the MQTT broker to which a NanoMQ instance is configured to connect - via DNS hijacking, BGP poisoning, or a rogue broker in a test or staging environment - sends a single 35-byte crafted MQTTv5 CONNECT packet containing will properties but no connect-level properties. The NanoMQ client process immediately dereferences the NULL prop pointer, receives SIGSEGV, and terminates. In bridge mode with auto-reconnect enabled, the client repeatedly reconnects and crashes in an infinite loop, sustaining process-level denial of service without any further attacker interaction.