What is the CVSS score of EUVD-2026-17209?

EUVD-2026-17209 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-17209?

Yes, a patch is available for EUVD-2026-17209. Update the affected software to the latest version immediately.

Nanomq EUVD-2026-17209

| CVE-2026-32696 LOW

NULL Pointer Dereference (CWE-476)

2026-03-30 GitHub_M

Null Pointer Dereference Denial Of Service Nanomq

3.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

3.1 LOW

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

0.24.7

EUVD ID Assigned

Mar 30, 2026 - 20:30 euvd

EUVD-2026-17209

Analysis Generated

Mar 30, 2026 - 20:30 vuln.today

CVE Published

Mar 30, 2026 - 20:11 nvd

LOW 3.1

DescriptionGitHub Advisory

NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In NanoMQ version 0.24.6, after enabling auth.http_auth (HTTP authentication), when a client connects to the broker using MQTT CONNECT without providing username/password, and the configuration params uses the placeholders %u / %P (e.g., username="%u", password="%P"), the HTTP request construction phase enters auth_http.c:set_data(). This results in calling strlen() on a NULL pointer, causing a SIGSEGV crash. This crash can be triggered remotely, resulting in a denial of service. This issue has been patched in version 0.24.7.

AnalysisAI

Remote denial of service in NanoMQ MQTT Broker 0.24.6 allows unauthenticated remote attackers to crash the broker by connecting without credentials when HTTP authentication is enabled with username/password placeholders, triggering a null pointer dereference in the auth_http.c module. The vulnerability requires high attack complexity (user interaction via specific MQTT CONNECT configuration) but results in broker unavailability. Vendor-released patch version 0.24.7 addresses the issue.

Technical ContextAI

NanoMQ is an MQTT message broker used in edge computing environments. The vulnerability exists in the HTTP authentication module (auth_http.c), specifically in the set_data() function responsible for constructing HTTP authentication requests. When HTTP authentication is enabled via auth.http_auth configuration, the broker attempts to validate MQTT CONNECT messages by forwarding credentials to an external HTTP server. The vulnerability occurs when configuration parameters use string placeholders %u (username) and %P (password) but a client connects without providing credentials, leaving these values NULL. The set_data() function unsafely calls strlen() on these NULL pointers without validation, causing a SIGSEGV signal that terminates the broker process. This is a classic null pointer dereference (CWE-476) in memory safety-critical authentication code. The CPE cpe:2.3:a:nanomq:nanomq:*:*:*:*:*:*:*:* confirms the product family is affected across versions prior to the patch.

RemediationAI

Upgrade NanoMQ to version 0.24.7 or later, which includes the fix for null pointer handling in the auth_http.c module. The upstream fix is committed at https://github.com/nanomq/nanomq/commit/c20aa27e5290bb480a5315099952480d35f37a8b and integrated pull request https://github.com/nanomq/NanoNNG/pull/1394. For deployments unable to upgrade immediately, temporarily disable HTTP authentication (auth.http_auth) or avoid using %u/%P placeholders in authentication configuration parameters. Administrators should verify broker stability after upgrading and test HTTP authentication functionality with both authenticated and unauthenticated MQTT clients to confirm the crash is resolved.