CVE-2026-44639

Overview

NanoMQ prior to version 0.24.14 contains an algorithmic complexity vulnerability in its MQTT v5 property decoder. Specifically, the property parsing routine walks the entire linked list for each incoming property, resulting in O(N²) CPU work. A remote unauthenticated attacker can exploit this to cause a sustained denial of service by exhausting broker CPU resources.

Description

NanoMQ is an MQTT broker. Prior to 0.24.14, NanoMQ's MQTT v5 property decoder in nng/src/supplemental/mqtt/mqtt_codec.c uses property_append() to walk the entire linked list for each property added by decode_buf_properties(). A remote unauthenticated client can supply a PUBLISH or SUBSCRIBE packet containing many User Properties, causing O(N²) linked-list insertion and CPU work that makes the broker unresponsive; repeated packets can sustain the denial of service. This issue is fixed in version 0.24.14.

Impact

The primary impact is a denial of service affecting availability, making the MQTT broker unresponsive to legitimate clients. Integrity and confidentiality are not directly impacted by this specific flaw. Unauthenticated remote clients interacting with the MQTT service are capable of triggering this condition.

Remediation

Upgrade NanoMQ to version 0.24.14 or later where the property decoding linked-list insertion logic has been corrected. Ensure network perimeter controls restrict untrusted access to the MQTT broker port where feasible.

Risk context

This vulnerability is rated as low severity with a CVSS v3 score of 3.7, and EPSS data is currently unavailable. While the risk of remote disruption exists, exploitation requires sustained packet transmission and typically affects availability rather than data security.

Affected products

• NanoMQ < 0.24.14