CVE-2026-25627 | THREATINT

Description

NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to version 0.24.8, NanoMQ’s MQTT-over-WebSocket transport can be crashed by sending an MQTT packet with a deliberately large Remaining Length in the fixed header while providing a much shorter actual payload. The code path copies Remaining Length bytes without verifying that the current receive buffer contains that many bytes, resulting in an out-of-bounds read (ASAN reports OOB / crash). This is remotely triggerable over the WebSocket listener. This issue has been patched in version 0.24.8.

PUBLISHED Reserved 2026-02-04 | Published 2026-03-30 | Updated 2026-03-31 | Assigner GitHub_M

MEDIUM: 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Problem types

CWE-125: Out-of-bounds Read

Product status

< 0.24.8

affected

References

github.com/...nanomq/security/advisories/GHSA-w4rh-v3h2-j29x exploit

github.com/...nanomq/security/advisories/GHSA-w4rh-v3h2-j29x

github.com/nanomq/NanoNNG/pull/1405

github.com/...ommit/e80b30bad6d855593a68d18f2785bfaca6faf09e

github.com/nanomq/nanomq/releases/tag/0.24.8

cve.org (CVE-2026-25627)

nvd.nist.gov (CVE-2026-25627)

Download JSON