SB2026062997 - Multiple vulnerabilities in NanoMQ

Description

This security bulletin contains information about 2 vulnerabilities.

1) NULL pointer dereference (CVE-ID: CVE-2026-47275)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in nni_mqttv5_msg_decode_connect() when processing a crafted MQTTv5 CONNECT packet from a broker. A remote user can send a specially crafted packet to cause a denial of service.

The issue affects the NanoMQ MQTTv5 client receive path, including nanomq_cli and bridge mode, and user interaction is required because the client must connect to a malicious broker.

2) Memory leak (CVE-ID: CVE-2026-73979)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows an unauthenticated remote attacker to cause memory leaks in NanoMQ and reduce broker availability, with user interaction required.

The vulnerability exists due to unreleased memory allocations in NanoMQ's MQTT property decoding when processing a specially crafted sequence of packets. An unauthenticated remote attacker can replay the crafted packets to the broker's network endpoint, triggering the demonstrated leak of 896 bytes across 14 allocations.

Remediation

Install update from vendor's website.

References

• https://github.com/nanomq/nanomq/security/advisories/GHSA-52qr-3v49-wmx6
• https://github.com/nanomq/nanomq/security/advisories/GHSA-wxff-mjhm-8hf5