EUVD-2026-46023Severity by source
AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L
PR:N because no privileges on the victim system are required; attacker needs only to operate a reachable broker. UI:R because the client must initiate connection to the malicious broker.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in nni_mqttv5_msg_decode_connect() allows a malicious MQTT broker to crash any connecting NanoMQ MQTTv5 client (including bridge mode) with a single packet, causing remote denial of service via SIGSEGV. In nni_mqttv5_msg_decode_connect() (mqtt_codec.c:1863), the code iterates over CONNECT properties using variable prop when it should use will_prop. When a CONNECT packet has no connect-level properties (prop == NULL) but has will properties (will_prop != NULL), dereferencing prop->next causes SIGSEGV at address 0x38 (NULL + offsetof(property, next)).
This affects both nanomq_cli and NanoMQ bridge mode (Core component), as both use the same mqtt_client.c receive path. This can lead to remote DoS if a malicious MQTT broker can crash the client process with a single 35-byte packet and persistent DoS if auto-reconnect causes infinite crash loop.
AnalysisAI
NULL pointer dereference in NanoMQ 0.24.11 and earlier allows a malicious MQTT broker to remotely crash any connecting NanoMQ MQTTv5 client - including bridge mode - with a single 35-byte crafted packet, triggering SIGSEGV and denial of service. The bug in mqtt_codec.c:1863 arises when a CONNECT packet carries will properties (will_prop != NULL) but no connect-level properties (prop == NULL); the code erroneously dereferences prop->next, reading from virtual address 0x38 (NULL plus struct field offset). No CISA KEV listing or public exploit is confirmed at time of analysis, but the minimal 35-byte trigger and auto-reconnect behavior in bridge mode can convert a single crash into a persistent DoS loop.
Technical ContextAI
NanoMQ is an MQTT broker and client suite targeting edge computing and IoT deployments. The vulnerable function nni_mqttv5_msg_decode_connect() in mqtt_codec.c decodes MQTTv5 CONNECT packets and iterates over packet properties. CWE-476 (NULL Pointer Dereference) applies directly: the property-iteration loop uses the pointer variable prop (connect-level properties) rather than will_prop (will-message properties) when traversing will properties. If an incoming CONNECT packet legitimately includes will properties (will_prop != NULL) while omitting connect-level properties (prop == NULL), the code attempts to read prop->next, dereferencing a NULL pointer offset by the next field's struct offset (0x38), causing an immediate SIGSEGV. Both the nanomq_cli command-line tool and NanoMQ bridge mode consume the same shared receive path in mqtt_client.c, making both components identically vulnerable. Affected CPE: cpe:2.3:a:nanomq:nanomq:*:*:*:*:*:*:*:* covering all variants through version 0.24.11.
RemediationAI
The primary fix is to upgrade NanoMQ to a version beyond 0.24.11 once a patched release is published; the exact fixed version is not stated in available data and should be confirmed via the vendor advisory at https://github.com/nanomq/nanomq/security/advisories/GHSA-52qr-3v49-wmx6 before deploying. As an immediate compensating control, restrict NanoMQ clients and bridge-mode instances to connect only to verified, trusted MQTT brokers by enforcing TLS mutual authentication with certificate pinning, preventing redirection to attacker-controlled brokers - note this requires PKI infrastructure and may complicate dynamic broker discovery. If bridge mode is not operationally required, disable it to eliminate the automated reconnect attack path that converts a single crash into persistent DoS. Disabling auto-reconnect in client configurations reduces the persistence of the DoS even when the underlying null-dereference is triggered, at the cost of requiring manual service recovery after a crash event.
NanoMQ 0.17.5 has a one-byte heap-based buffer over-read in the conn_handler function of mqtt_parser.c when it processes
CVE-2024-42646 is a segmentation fault vulnerability in NanoMQ v0.21.10 that allows unauthenticated remote attackers to
Null Pointer Dereference vulnerability in topic_filtern function in mqtt_parser.c in NanoMQ 0.21.7 allows attackers to c
A use-after-free vulnerability exists in NanoMQ 0.17.2. Rated high severity (CVSS 7.5), this vulnerability is remotely e
A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. Rated high severity (CVSS 7.5), this vulnerability is remo
A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. Rated high severity (CVSS 7.5), this vulnerability is remo
A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. Rated high severity (CVSS 7.5), this vulnerability is remo
In NanoMQ v0.15.0-0, segment fault with Null Pointer Dereference occurs in the process of decoding subinfo_decode and un
In NanoMQ v0.15.0-0, a Heap overflow occurs in copyn_utf8_str function of mqtt_parser.c. Rated high severity (CVSS 7.5),
In NanoMQ v0.15.0-0, Heap overflow occurs in read_byte function of mqtt_code.c. Rated high severity (CVSS 7.5), this vul
A heap-buffer-overflow vulnerability in the read_byte function in NanoMQ v.0.21.7 allows attackers to cause a denial of
NanoMQ v0.22.10 was discovered to contain a memory leak which allows attackers to cause a Denial of Service (DoS) via a
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today