CVE-2026-44639
lowNanoMQ is an MQTT broker.
NanoMQ is an MQTT broker. Prior to 0.24.14, NanoMQ's MQTT v5 property decoder in nng/src/supplemental/mqtt/mqtt_codec.c uses property_append() to walk the entire linked list for each property added by decode_buf_properties(). A remote unauthenticated client can supply a PUBLISH or SUBSCRIBE packet containing many User Properties, causing O(N²) linked-list insertion and CPU work that makes the broker unresponsive; repeated packets can sustain the denial of service. This issue is fixed in version 0.24.14.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/nanomq/NanoNNG/commit/91bd4c7f45f945a3f5f0e37c459157dc7c277a07 security-advisories@github.com
- https://github.com/nanomq/NanoNNG/pull/1508 security-advisories@github.com
- https://github.com/nanomq/nanomq/releases/tag/0.24.14 security-advisories@github.com
- https://github.com/nanomq/nanomq/security/advisories/GHSA-6mwg-445v-2qrv security-advisories@github.com
- https://github.com/nanomq/nanomq/security/advisories/GHSA-6mwg-445v-2qrv 134c704f-9b21-4f2e-91b3-4a467353bcc0