Executive brief
NanoMQ is an open-source messaging platform used for communication between edge devices and cloud systems. A flaw in how the software handles secure QUIC connections can cause the system to hang or crash when a connection attempt is canceled or closed. This could allow an attacker to disrupt messaging services, leading to a denial-of-service condition that impacts real-time data operations.
Technical details
A type confusion vulnerability exists in NanoMQ's QUIC implementation within `nng/src/supplemental/quic/msquic_dial.c`. During the dialing process, the `aio->prov_data` field is populated with a pointer of type `nni_quic_conn*`; however, during the dialer close path, the code incorrectly attempts to read this data as an `ex_quic_conn*`. This incompatible type interpretation leads to invalid memory access, resulting in a process hang or crash (Denial of Service). Exploitation requires specific timing during the connection phase and is categorized as having high complexity. The issue is resolved in version 0.24.14.
Affected products
- EMQ NanoMQ < 0.24.14
Timeline
- 2026-05-19: advisory: GitHub Security Advisory published
- 2026-05-29: patched: Version 0.24.14 released with fix
- 2026-05-29: disclosed: CVE-2026-44640 published to NVD