Memory leak in NanoMQ - CVE-2026-73979
Published: November 9, 2026
Vulnerability identifier: #VU163016
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-73979
CWE-ID: CWE-401
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to cause memory leaks in NanoMQ and reduce broker availability, with user interaction required.
The vulnerability exists due to unreleased memory allocations in NanoMQ's MQTT property decoding when processing a specially crafted sequence of packets. An unauthenticated remote attacker can replay the crafted packets to the broker's network endpoint, triggering the demonstrated leak of 896 bytes across 14 allocations.
Affected software
NanoMQ
How to mitigate CVE-2026-73979
Install security update from vendor's website.
NanoMQ - update to 0.24.12