Nanomq EUVD-2026-23939

Exploitation requires the NanoMQ REST API feature to be enabled and network-accessible to the attacker. The REST API is a standard component of NanoMQ but may not be exposed in all deployments depending on firewall rules, network segmentation, or configuration choices to disable HTTP management interfaces. No authentication is required (CVSS PR:N) and default configurations with REST API enabled are vulnerable. No user interaction needed (UI:N). Exploitation is NOT limited by specific MQTT protocol configurations, client connections, or broker clustering modes - any NanoMQ instance with reachable REST API endpoints on TCP ports (typically 8081 or 18083) can be targeted. Attack complexity is low (AC:L) as crafting the malicious query parameter requires only basic HTTP client tools and knowledge of the parser flaw.

Real-world risk is moderate-high for internet-exposed NanoMQ deployments despite the 7.7 CVSS score. The CVSS vector confirms worst-case network exploitability: AV:N (network accessible), AC:L (low complexity), PR:N (no authentication), UI:N (no user interaction). However, the impact is limited to availability (VA:H) with no confidentiality or integrity compromise in the base metric. The E:P (Proof-of-concept) indicator confirms exploit code exists, lowering the skill barrier for attackers. Absence from CISA KEV suggests this is not yet widely exploited in the wild, likely due to NanoMQ's niche deployment in edge/IoT environments rather than enterprise infrastructure. The primary risk is denial of service against MQTT messaging infrastructure, which could disrupt IoT device communications, industrial sensors, or edge data pipelines. Organizations using NanoMQ in production edge deployments face higher risk than those in development/testing. The availability of a clean vendor patch (0.24.11) and specific commit reference (69a97b3) indicates straightforward remediation, reducing residual risk for patched systems. Attack automation is feasible given the low complexity and documented POC, making this a realistic target for vulnerability scanners and opportunistic attacks against exposed REST API endpoints.

An attacker identifies an internet-exposed NanoMQ broker instance through port scanning or IoT device reconnaissance (common on ports 8081/18083 for REST API). They craft an HTTP GET or POST request to any REST API endpoint with maliciously formatted query parameters containing precise byte sequences to trigger the off-by-one overflow in uri_param_parse. The null byte write corrupts heap metadata, causing NanoMQ to crash and disrupting MQTT messaging services for connected IoT devices or edge applications. With proof-of-concept code publicly available, attackers can automate this attack against vulnerable targets without deep exploit development expertise.