CVE-2026-47276

In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in "propertiesparse" allows an authenticated attacker to crash the NanoMQ broker by sending a POST request to "/api/v4/mqtt/publish" with "userproperties" as a JSON array instead of a JSON object. The crash occurs because "strlen"...

CVE-2026-47276: NULL Pointer Dereference

In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in propertiesparse allows an authenticated attacker to crash the NanoMQ broker by sending a POST request to /api/v4/mqtt/publish with userproperties as a JSON array instead of a JSON object. The crash occurs because strlen is call...