EUVD-2026-46025Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
REST API is network-reachable but requires credentials (PR:L); crash kills only the broker process with no data exposure and no scope change (C:N, I:N, S:U, A:H).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in properties_parse() allows an authenticated attacker to crash the NanoMQ broker by sending a POST request to /api/v4/mqtt/publish with user_properties as a JSON array instead of a JSON object. The crash occurs because strlen() is called on a NULL item->string pointer when iterating over array elements. An authenticated attacker can exploit this to crash the NanoMQ broker process. This is patched in version 0.24.14.
AnalysisAI
NULL pointer dereference in NanoMQ 0.24.11 and earlier allows an authenticated REST API user to crash the entire broker process with a single malformed HTTP request. The properties_parse() function fails to validate that user_properties is a JSON object before iterating its elements, calling strlen() on a NULL pointer and causing a fatal segmentation fault. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis; a vendor patch is available in version 0.24.14.
Technical ContextAI
NanoMQ is a lightweight MQTT 5.0 broker targeting IoT edge computing scenarios, built on the NNG (nanomsg-next-generation) transport library. The vulnerable code path is in properties_parse(), the function responsible for deserializing MQTT user properties submitted via the HTTP REST API endpoint POST /api/v4/mqtt/publish. The root cause is CWE-476 (NULL Pointer Dereference): the MQTT specification defines user properties as key-value pairs (i.e., a JSON object), but the parser performs no type validation before iterating. When a JSON array is supplied instead, array elements carry no named key, leaving item->string as NULL. The subsequent unconditional strlen(item->string) call dereferences this NULL pointer and terminates the process. Affected product scope is confirmed by CPE cpe:2.3:a:nanomq:nanomq:*:*:*:*:*:*:*:* covering all versions through 0.24.11.
RemediationAI
Upgrade NanoMQ to version 0.24.14 or later, which patches the NULL pointer dereference in properties_parse() by adding type validation before iterating user_properties elements. Full details are in the vendor advisory at https://github.com/nanomq/nanomq/security/advisories/GHSA-qq2v-xvxg-3hvf. If immediate upgrade is not operationally feasible, restrict network access to the NanoMQ REST API port using firewall rules or a reverse proxy ACL so that only known, trusted clients can reach the /api/v4/mqtt/publish endpoint - note this workaround may break legitimate publish workflows and must be coordinated with application owners. Additionally, audit and rotate REST API credentials to reduce the set of principals capable of triggering the flaw. Because the crash terminates the entire broker process, deploy a process supervisor (systemd, supervisor, Kubernetes restart policy) as a compensating control to restore availability automatically after a crash, accepting that brief disruption will still occur on each exploit attempt.
NanoMQ 0.17.5 has a one-byte heap-based buffer over-read in the conn_handler function of mqtt_parser.c when it processes
CVE-2024-42646 is a segmentation fault vulnerability in NanoMQ v0.21.10 that allows unauthenticated remote attackers to
Null Pointer Dereference vulnerability in topic_filtern function in mqtt_parser.c in NanoMQ 0.21.7 allows attackers to c
A use-after-free vulnerability exists in NanoMQ 0.17.2. Rated high severity (CVSS 7.5), this vulnerability is remotely e
A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. Rated high severity (CVSS 7.5), this vulnerability is remo
A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. Rated high severity (CVSS 7.5), this vulnerability is remo
A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. Rated high severity (CVSS 7.5), this vulnerability is remo
In NanoMQ v0.15.0-0, segment fault with Null Pointer Dereference occurs in the process of decoding subinfo_decode and un
In NanoMQ v0.15.0-0, a Heap overflow occurs in copyn_utf8_str function of mqtt_parser.c. Rated high severity (CVSS 7.5),
In NanoMQ v0.15.0-0, Heap overflow occurs in read_byte function of mqtt_code.c. Rated high severity (CVSS 7.5), this vul
A heap-buffer-overflow vulnerability in the read_byte function in NanoMQ v.0.21.7 allows attackers to cause a denial of
NanoMQ v0.22.10 was discovered to contain a memory leak which allows attackers to cause a Denial of Service (DoS) via a
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today