Executive brief
NanoMQ is an open-source MQTT message broker used for IoT and real-time messaging. A remote attacker can crash the broker by sending a malformed MQTT SUBSCRIBE packet, causing a denial of service. The vulnerability affects the broker's message parsing logic and allows an unauthenticated client to trigger a heap buffer over-read without requiring any special network conditions.
Technical details
The nmq_subinfo_decode() function in mqtt_parser.c incorrectly reuses the outer Properties Length variable when parsing multiple SUBSCRIPTION_IDENTIFIER fields, causing get_var_integer() to read from an incorrect heap offset. An attacker sends a SUBSCRIBE packet with a multi-byte Properties Length and repeated subscription identifiers to trigger the over-read. The flaw is remotely exploitable and results in broker crash; a patch is available in version 0.24.14.
Affected products
- NanoMQ NanoMQ prior to 0.24.14
Timeline
- 2026-09-18: disclosed
- 2026-05-20: patched: Fix merged in PR #1518