rootpwn

low · CVSS v3 2

CVE-2026-61633

NanoMQ MQTT broker is vulnerable to malformed UNSUBSCRIBE packets that can cause client hangs and resource exhaustion. The flaw resides in n

Overview

NanoMQ MQTT broker is vulnerable to malformed UNSUBSCRIBE packets that can cause client hangs and resource exhaustion. The flaw resides in nni_mqtt_msg_decode_unsubscribe() before version 0.24.14. Updating to 0.24.14 or later mitigates the issue.

Description

NanoMQ is an MQTT broker. Prior to 0.24.14, the NanoMQ client function nni_mqtt_msg_decode_unsubscribe() in nng/src/supplemental/mqtt/mqtt_codec.c does not handle a failed read_uint16() while counting topics in a malformed UNSUBSCRIBE packet. A zero-length topic followed by trailing data can leave buf.curpos unchanged while topic_count continues to increase, allowing a malicious MQTT broker to hang a connecting MQTT 3.1.1 client, consume CPU and memory, and repeatedly deny service when automatic reconnection is enabled. The broker-side nmq_unsubinfo_decode path is not affected. This issue is fixed in version 0.24.14.

Impact

Denial of Service: Availability is compromised as clients can be hung, leading to increased CPU and memory usage. Confidentiality and integrity are not directly affected. Defenders should monitor client connection patterns and resource consumption.

Remediation

Upgrade NanoMQ to version 0.24.14 or later. If upgrade is not possible, disable automatic reconnection on clients or implement rate limiting on UNSUBSCRIBE packets. Apply any vendor-supplied patches.

Risk context

Severity is low (CVSS 2.0) and no EPSS data; the risk is moderate for environments with high client churn or automatic reconnection. Defenders should assess exposure but the threat is not critical.

Affected products

  • NanoMQ 0.24.13
  • NanoMQ 0.24.12
  • NanoMQ 0.24.11
  • NanoMQ 0.24.10
  • NanoMQ 0.24.9
  • NanoMQ 0.24.8
  • NanoMQ 0.24.7
  • NanoMQ 0.24.6

Scores

Severity
low
CVSS v2
1.7
CVSS v3
2
CVSS v4
—
EPSS
—

mqtt denial-of-service nanomq client-hang resource-exhaustion low-severity

← All CVEs

Related CVEs

low

CVE-2026-44639

NanoMQ prior to version 0.24.14 contains an algorithmic complexity vulnerability in its MQTT v5 property decoder. Specifically, the property parsing routine walks the entire linked list for each incoming property, resulting in O(N²) CPU work. A remote unauthenticated attacker can exploit this to cause a sustained denial of service by exhausting broker CPU resources.

View analysis

low

CVE-2026-57225

Suricata versions 8.0.0 through 8.0.5 are vulnerable to a NULL pointer dereference in JSON/NDJSON dataset handling when a configured `value_key` is not a string. A malformed or unexpected dataset or rule feed can cause Suricata to crash during startup, configuration testing, or rule reload, prior to traffic processing. This issue is resolved in Suricata 8.0.6.

View analysis

low

CVE-2026-63449

Suricata's SIP parser in versions 8.0.0 through 8.0.5 stores SIP request and response body lengths in 16-bit fields. SIP bodies larger than 65,536 bytes can cause length truncation, preventing frame-based body inspection from seeing the full content. This matters because omitted body content may evade detection rules that rely on frame:request.body or frame:response.body.

View analysis

low

CVE-2026-63450

Suricata versions before 8.0.6 mishandle certain FTP command sequences by treating an early RETR or STOR as a fatal parser error. This can disable FTP application-layer parsing for the rest of the TCP flow, reducing rule coverage and logging visibility. The issue is fixed in Suricata 8.0.6.

View analysis