CVE-2026-47276

Summary

In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in properties_parse() allows an authenticated attacker to crash the NanoMQ broker by sending a POST request to /api/v4/mqtt/publish with user_properties as a JSON array instead of a JSON object. The crash occurs because strlen() is called on a NULL item->string pointer when iterating over array elements. An authenticated attacker can exploit this to crash the NanoMQ broker process. This is patched in version 0.24.14.

Affected Software

Weaknesses

• CWE-476: CWE-476: NULL Pointer Dereference

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

Additional References

• https://github.com/nanomq/nanomq/security/advisories/GHSA-qq2v-xvxg-3hvf

References

• https://github.com/nanomq/nanomq/security/advisories/GHSA-qq2v-xvxg-3hvf

• ←Previous
• Next→