NanoMQ-Memory-Leak-Research

CVE-2026-36590: EMQ NanoMQ v0.24.9의 서비스 거부Denial of Service 이 저장소는 EMQ NanoMQ v0.24.9에 영향을 미치는 서비스 거부 취약점인 CVE-2026-36590에 대한 공개 권고 및 기술 분석을 포함합니다. 검토 참고 사항 이 저장소는 CVE 검토를 위한 접근 가능한 기술 참고 자료를 제공하기 위해 공개되어 있습니다. CVE-2026-36590의 최종 분류는 CVE 팀 또는 관련 CNA가 결정합니다. NanoMQ 팀은 이 이슈에 대해 이의를 제기했으며 이를 구성설정 관련...

CVE-2026-73863

NanoMQ is an MQTT broker. Prior to 0.24.14, NanoMQ's broker-side MQTT v5 nmqsubinfodecode function in nng/src/sp/protocol/mqtt/mqttparser.c reuses lenofvarint from the outer Properties Length while parsing each SUBSCRIPTIONIDENTIFIER. A remote client can send a SUBSCRIBE packet with a multi-byte...

CVE-2026-61633

NanoMQ is an MQTT broker. Prior to 0.24.14, the NanoMQ client function nnimqttmsgdecodeunsubscribe in nng/src/supplemental/mqtt/mqttcodec.c does not handle a failed readuint16 while counting topics in a malformed UNSUBSCRIBE packet. A zero-length topic followed by trailing data can leave buf.curp...

CVE-2026-44639

NanoMQ is an MQTT broker. Prior to 0.24.14, NanoMQ's MQTT v5 property decoder in nng/src/supplemental/mqtt/mqttcodec.c uses propertyappend to walk the entire linked list for each property added by decodebufproperties. A remote unauthenticated client can supply a PUBLISH or SUBSCRIBE packet...

CVE-2026-73863 NanoMQ: Heap-Buffer-Overflow in `nmq_subinfo_decode()` During MQTT v5 SUBSCRIBE Parsing

NanoMQ is an MQTT broker. Prior to 0.24.14, NanoMQ's broker-side MQTT v5 nmqsubinfodecode function in nng/src/sp/protocol/mqtt/mqttparser.c reuses lenofvarint from the outer Properties Length while parsing each SUBSCRIPTIONIDENTIFIER. A remote client can send a SUBSCRIBE packet with a multi-byte...

CVE-2026-73863 NanoMQ: Heap-Buffer-Overflow in `nmq_subinfo_decode()` During MQTT v5 SUBSCRIBE Parsing

NanoMQ is an MQTT broker. Prior to 0.24.14, NanoMQ's broker-side MQTT v5 nmqsubinfodecode function in nng/src/sp/protocol/mqtt/mqttparser.c reuses lenofvarint from the outer Properties Length while parsing each SUBSCRIPTIONIDENTIFIER. A remote client can send a SUBSCRIBE packet with a multi-byte...

CVE-2026-73863 NanoMQ: Heap-Buffer-Overflow in `nmq_subinfo_decode()` During MQTT v5 SUBSCRIBE Parsing

NanoMQ is an MQTT broker. Prior to 0.24.14, NanoMQ's broker-side MQTT v5 nmqsubinfodecode function in nng/src/sp/protocol/mqtt/mqttparser.c reuses lenofvarint from the outer Properties Length while parsing each SUBSCRIPTIONIDENTIFIER. A remote client can send a SUBSCRIBE packet with a multi-byte...

CVE-2026-73863

NanoMQ, an MQTT broker, contains a heap-buffer-overflow in the broker-side function nmq_subinfo_decode() located in nng/src/sp/protocol/mqtt/mqtt_parser.c. The root cause is an incorrect reuse of the len_of_varint value from the outer Properties Length field when parsing repeated SUBSCRIPTION_IDE...

EUVD-2026-83050

NanoMQ is an MQTT broker. Prior to 0.24.14, NanoMQ's broker-side MQTT v5 nmqsubinfodecode function in nng/src/sp/protocol/mqtt/mqttparser.c reuses lenofvarint from the outer Properties Length while parsing each SUBSCRIPTIONIDENTIFIER. A remote client can send a SUBSCRIBE packet with a multi-byte...

CVE-2026-61633 NanoMQ: Infinite Loop in UNSUBSCRIBE Decoder Leading to Remote DoS

NanoMQ is an MQTT broker. Prior to 0.24.14, the NanoMQ client function nnimqttmsgdecodeunsubscribe in nng/src/supplemental/mqtt/mqttcodec.c does not handle a failed readuint16 while counting topics in a malformed UNSUBSCRIBE packet. A zero-length topic followed by trailing data can leave buf.curp...

CVE-2026-61633

NanoMQ (MQTT broker) contains a flaw in its client-side function nni_mqtt_msg_decode_unsubscribe() in mqtt_codec.c. A malformed UNSUBSCRIBE packet with a zero-length topic followed by trailing data can cause a failed read_uint16() that leaves the buffer position unchanged while the topic count ke...

EUVD-2026-83048

NanoMQ is an MQTT broker. Prior to 0.24.14, the NanoMQ client function nnimqttmsgdecodeunsubscribe in nng/src/supplemental/mqtt/mqttcodec.c does not handle a failed readuint16 while counting topics in a malformed UNSUBSCRIBE packet. A zero-length topic followed by trailing data can leave buf.curp...

CVE-2026-61633 NanoMQ: Infinite Loop in UNSUBSCRIBE Decoder Leading to Remote DoS

NanoMQ is an MQTT broker. Prior to 0.24.14, the NanoMQ client function nnimqttmsgdecodeunsubscribe in nng/src/supplemental/mqtt/mqttcodec.c does not handle a failed readuint16 while counting topics in a malformed UNSUBSCRIBE packet. A zero-length topic followed by trailing data can leave buf.curp...

CVE-2026-61633 NanoMQ: Infinite Loop in UNSUBSCRIBE Decoder Leading to Remote DoS

NanoMQ is an MQTT broker. Prior to 0.24.14, the NanoMQ client function nnimqttmsgdecodeunsubscribe in nng/src/supplemental/mqtt/mqttcodec.c does not handle a failed readuint16 while counting topics in a malformed UNSUBSCRIBE packet. A zero-length topic followed by trailing data can leave buf.curp...

CVE-2026-44639 NanoMQ: O(N²) Denial of Service in MQTT v5 Property Parsing

NanoMQ is an MQTT broker. Prior to 0.24.14, NanoMQ's MQTT v5 property decoder in nng/src/supplemental/mqtt/mqttcodec.c uses propertyappend to walk the entire linked list for each property added by decodebufproperties. A remote unauthenticated client can supply a PUBLISH or SUBSCRIBE packet...

CVE-2026-44639 NanoMQ: O(N²) Denial of Service in MQTT v5 Property Parsing

NanoMQ is an MQTT broker. Prior to 0.24.14, NanoMQ's MQTT v5 property decoder in nng/src/supplemental/mqtt/mqttcodec.c uses propertyappend to walk the entire linked list for each property added by decodebufproperties. A remote unauthenticated client can supply a PUBLISH or SUBSCRIBE packet...

CVE-2026-44639 NanoMQ: O(N²) Denial of Service in MQTT v5 Property Parsing

NanoMQ is an MQTT broker. Prior to 0.24.14, NanoMQ's MQTT v5 property decoder in nng/src/supplemental/mqtt/mqttcodec.c uses propertyappend to walk the entire linked list for each property added by decodebufproperties. A remote unauthenticated client can supply a PUBLISH or SUBSCRIBE packet...

CVE-2026-44639

NanoMQ , an MQTT broker, is vulnerable to an O(N²) denial of service in its MQTT v5 property decoder (in nng/src/supplemental/mqtt/mqtt_codec.c). The root cause is that property_append() traverses the entire linked list for each property added by decode_buf_properties(), resulting in quadratic CP...

EUVD-2026-83047

NanoMQ is an MQTT broker. Prior to 0.24.14, NanoMQ's MQTT v5 property decoder in nng/src/supplemental/mqtt/mqttcodec.c uses propertyappend to walk the entire linked list for each property added by decodebufproperties. A remote unauthenticated client can supply a PUBLISH or SUBSCRIBE packet...

CVE-2026-73863: Out-of-bounds Read

NanoMQ is an MQTT broker. Prior to 0.24.14, NanoMQ's broker-side MQTT v5 nmqsubinfodecode function in nng/src/sp/protocol/mqtt/mqttparser.c reuses lenofvarint from the outer Properties Length while parsing each SUBSCRIPTIONIDENTIFIER. A remote client can send a SUBSCRIBE packet with a multi-byte...