Quick answers
- Is CVE-2026-35217 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-35217 being exploited in the wild.
- How severe is CVE-2026-35217?
- Medium severity, with a CVSS score of 6.5, published 20 July 2026.
- Which products and versions are affected?
- EMQ NanoMQ <= 0.24.14.
- Is there a fix for CVE-2026-35217?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-35217 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-35217?
- Check whether you run EMQ NanoMQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A vulnerability exists in nmq_subinfo_decode() within nng/src/sp/protocol/mqtt/mqtt_parser.c due to an off-by-one boundary check. When an MQTT v5 SUBSCRIBE packet is missing the 1-byte 'Subscription Options' field, the parser uses a 'bpos > remain' check that allows a read to occur when 'bpos == remain'. This results in a 1-byte out-of-bounds read. Depending on the heap layout and message size (specifically when the message body is exactly 1024 bytes, triggering an exact allocation in nni_msg_alloc), this can manifest as a heap-buffer-overflow or as a semantic flaw where malformed subscriptions are incorrectly accepted and installed into the broker's internal state.
Affected products
- nanomq NanoMQ <= 0.24.14
Timeline
- 2026-06-23: advisory: GitHub Security Advisory published
- 2026-07-20: disclosed: NVD publication date