EUVD-2026-83048Severity by source
AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:L
Malicious broker needs no privileges on the client (PR:N, disagreeing with vendor PR:H); luring/redirecting the client to a hostile broker raises complexity (AC:H, UI:R); pure availability loss of one client (A:L).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
NanoMQ is an MQTT broker. Prior to 0.24.14, the NanoMQ client function nni_mqtt_msg_decode_unsubscribe() in nng/src/supplemental/mqtt/mqtt_codec.c does not handle a failed read_uint16() while counting topics in a malformed UNSUBSCRIBE packet. A zero-length topic followed by trailing data can leave buf.curpos unchanged while topic_count continues to increase, allowing a malicious MQTT broker to hang a connecting MQTT 3.1.1 client, consume CPU and memory, and repeatedly deny service when automatic reconnection is enabled. The broker-side nmq_unsubinfo_decode path is not affected. This issue is fixed in version 0.24.14.
AnalysisAI
The NanoMQ MQTT client (versions prior to 0.24.14) can be hung and driven into a CPU- and memory-consuming infinite loop by a malicious or compromised MQTT broker that replies to a client UNSUBSCRIBE exchange with a malformed packet containing a zero-length topic followed by trailing data. The defect is CWE-835 in nni_mqtt_msg_decode_unsubscribe() (nng/src/supplemental/mqtt/mqtt_codec.c), where a failed read_uint16() during topic counting leaves buf.curpos unchanged while topic_count keeps incrementing, so the parse loop never terminates; when automatic reconnection is enabled the client re-enters the same state repeatedly, producing a sustained denial of service against the client itself. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the victim to be a NanoMQ MQTT *client* (version prior to 0.24.14) using MQTT 3.1.1 that connects to an attacker-controlled or compromised broker (or an on-path attacker who can inject the crafted response); the malformed UNSUBSCRIBE packet must contain a zero-length topic followed by trailing data to trigger the loop in nni_mqtt_msg_decode_unsubscribe(). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a low-priority DoS with an inverted threat model: the vulnerable component is the NanoMQ MQTT *client*, and the attacker is a malicious/compromised MQTT broker that the client connects to (prior to v0.24.14). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to NanoMQ 0.24.14, which is the vendor-released patch for this issue (release tag: https://github.com/nanomq/nanomq/releases/tag/0.24.14); the underlying fix is in NanoNNG PR #1518 (https://github.com/nanomq/NanoNNG/pull/1518, commit fa8d859bb39841e46cfc6cce280d242bd782ad3d) and adds MQTT_ERR_PROTOCOL propagation to nni_mqtt_msg_decode_unsubscribe() and the sibling subscribe decoders. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
NanoMQ 0.17.5 has a one-byte heap-based buffer over-read in the conn_handler function of mqtt_parser.c when it processes
CVE-2024-42646 is a segmentation fault vulnerability in NanoMQ v0.21.10 that allows unauthenticated remote attackers to
Null Pointer Dereference vulnerability in topic_filtern function in mqtt_parser.c in NanoMQ 0.21.7 allows attackers to c
A use-after-free vulnerability exists in NanoMQ 0.17.2. Rated high severity (CVSS 7.5), this vulnerability is remotely e
A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. Rated high severity (CVSS 7.5), this vulnerability is remo
A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. Rated high severity (CVSS 7.5), this vulnerability is remo
A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. Rated high severity (CVSS 7.5), this vulnerability is remo
In NanoMQ v0.15.0-0, segment fault with Null Pointer Dereference occurs in the process of decoding subinfo_decode and un
In NanoMQ v0.15.0-0, a Heap overflow occurs in copyn_utf8_str function of mqtt_parser.c. Rated high severity (CVSS 7.5),
In NanoMQ v0.15.0-0, Heap overflow occurs in read_byte function of mqtt_code.c. Rated high severity (CVSS 7.5), this vul
A heap-buffer-overflow vulnerability in the read_byte function in NanoMQ v.0.21.7 allows attackers to cause a denial of
NanoMQ v0.22.10 was discovered to contain a memory leak which allows attackers to cause a Denial of Service (DoS) via a
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today