CVE-2026-47276

CVE-2026-47276 affects NanoMQ up to version 0.24.11: a NULL pointer dereference in properties_parse() when processing user_properties, allowing an authenticated attacker to crash the broker by sending a crafted POST to /api/v4/mqtt/publish with user_properties as a JSON array (strlen on a NULL it...