# CVE-2026-36590: EMQ NanoMQ denial of service via memory leak in nni_qos_db_set

Source: https://junglewise.ai/threats/cve-2026-36590-emq-nanomq-denial-of-service-via-memory-leak-in-nni-qos-db-set  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-36590 · Severity: info · CVSS 7.5 · Published 2026-07-15

EMQ NanoMQ is a lightweight messaging broker used for Internet of Things (IoT) communications. A vulnerability in the way it handles message quality-of-service (QoS) data allows a remote attacker to trigger a memory leak. Over time, this consumes all available system memory, causing the messaging service to crash and disrupting communication between IoT devices.

Technologies: [EMQ NanoMQ](https://junglewise.ai/threats/technologies/nanomq). Vendors: [EMQ](https://junglewise.ai/threats/vendors/emq).

## Quick answers

**Is CVE-2026-36590 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-36590 being exploited in the wild.

**How severe is CVE-2026-36590?** Informational severity, with a CVSS score of 7.5, published 15 July 2026.

**Which products and versions are affected?** EMQ NanoMQ v0.24.9.

**Is there a fix for CVE-2026-36590?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-36590 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-36590?** Check whether you run EMQ NanoMQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A resource exhaustion vulnerability exists in EMQ NanoMQ v0.24.9 due to a memory leak in the nni_qos_db_set function within the broker_tcp.c and mqtt_qos_db_api.c components. The flaw is triggered when processing certain MQTT packets, leading to unreleased memory allocations (CWE-772). A remote, unauthenticated attacker can exploit this by sending a sequence of crafted packets, eventually exhausting system RAM and causing a denial of service. While the NanoMQ team has disputed the issue as configuration-related, technical analysis and AddressSanitizer (ASAN) logs confirm the leak occurs during routine QoS database operations.

## Affected products

- EMQ NanoMQ v0.24.9

## Timeline

- 2026-06-17: disclosed: Initial public disclosure by researcher
- 2026-07-15: advisory: CVE published to NVD dataset

## References

- [https://github.com/MoXie25/NanoMQ-Memory-Leak-Research.git](https://github.com/MoXie25/NanoMQ-Memory-Leak-Research.git)
- [https://github.com/MoXie25/NanoMQ-Memory-Leak-Research/blob/main/README.md](https://github.com/MoXie25/NanoMQ-Memory-Leak-Research/blob/main/README.md)

## Related threats

- [NanoMQ NULL pointer dereference in REST API properties_parse](https://junglewise.ai/threats/cve-2026-47276-nanomq-null-pointer-dereference-in-rest-api-properties-parse)
- [NanoMQ NULL pointer dereference in nni_mqttv5_msg_decode_connect](https://junglewise.ai/threats/cve-2026-47275-nanomq-null-pointer-dereference-in-nni-mqttv5-msg-decode-connect)
- [NanoMQ MQTT v5 SUBSCRIBE out-of-bounds read and semantic flaw](https://junglewise.ai/threats/cve-2026-35217-nanomq-mqtt-v5-subscribe-out-of-bounds-read-and-semantic-flaw)
- [NanoMQ type confusion in QUIC dialer close path](https://junglewise.ai/threats/cve-2026-44640-nanomq-type-confusion-in-quic-dialer-close-path)
- [NanoMQ NULL pointer dereference in tcptran_pipe_peer](https://junglewise.ai/threats/cve-2026-32134-nanomq-null-pointer-dereference-in-tcptran-pipe-peer)