EUVD-2026-44847
GHSA-2gm5-wc63-c2pc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable broker, unauthenticated MQTT traffic with low complexity (AV:N/AC:L/PR:N/UI:N); memory-leak resource exhaustion yields availability-only impact (A:H, C:N/I:N).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
4DescriptionCVE.org
An issue in EMQ NanoMQ v.0.24.9 allows a remote attacker to cause a denial of service via the nni_qos_db_set function in broker_tcp.c component
AnalysisAI
Remote denial of service in EMQ NanoMQ 0.24.9 lets an unauthenticated network attacker exhaust broker resources through the nni_qos_db_set function in the broker_tcp.c TCP-handling component, degrading or crashing the MQTT broker (CVSS 7.5, availability-only). Publicly available exploit/research code exists in a memory-leak research repository, but there is no public evidence of active exploitation and EPSS estimates a low 0.29% (21st percentile) exploitation probability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the NanoMQ 0.24.9 TCP MQTT listener (broker_tcp.c path) and the ability to send MQTT traffic that reaches the nni_qos_db_set QoS-database code - i.e., QoS 1/2 publish/subscribe interactions over a standard MQTT-over-TCP connection; per the CVSS vector (PR:N/UI:N) no authentication or user interaction is required against a reachable broker. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) describes a network-reachable, low-complexity, unauthenticated attack with high availability impact and no confidentiality or integrity impact - consistent with a resource-exhaustion DoS against an internet- or LAN-exposed broker. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with network reach to an exposed NanoMQ 0.24.9 broker opens TCP MQTT connections and sends crafted QoS-flagged messages/subscriptions that repeatedly invoke nni_qos_db_set, causing the broker to accumulate QoS state that is never freed. Sustained traffic drives memory consumption until the broker slows, drops legitimate IoT clients, or is killed by the OS, taking down the messaging backbone. … |
| Remediation | No vendor-released patch identified at time of analysis; no fixed NanoMQ version is cited in the input, so monitor the NanoMQ GitHub project and EMQ advisories and upgrade to a released version that specifically addresses the broker_tcp.c / nni_qos_db_set resource leak once published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all EMQ NanoMQ 0.24.9 instances and restrict MQTT broker network access to authorized clients only via firewall rules or network segmentation to block untrusted traffic. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Unauthenticated remote OS command injection in MeiG Smart FORGE_SLT711 cellular gateway firmware MDM9607.LE.1.0-00110-ST
Unauthenticated API access in LalanaChami Pharmacy Management System (commit 5c3d028) allows remote attackers to dump al
In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write o
Giflib 5.2.2 contains a buffer overflow in the EGifGCBToExtension function that fails to validate allocated memory when
Denial of service in GPAC's MP4Box multimedia tool (versions before 26.02.0) arises from a use-after-free in the gf_sei_
Arbitrary kernel memory read/write in Realtek rtl819x Jungle SDK Wi-Fi driver allows local unprivileged attackers to acc
Denial of service in GPAC's MP4Box/libgpac media importer (versions before 26.02.0) lets an attacker crash the tool by s
An issue in the parse_month function (/time/strptime.rs) of relibc commit ab6a2e allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library) at commit 61f42d allows attackers to crash a process by ge
An issue in the pthread_rwlockattr_setpshared() function of relibc commit 61f42d allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library implementation, commit 61f42d) lets attackers crash a proce
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today