PT-2026-29123 · Nanomq · Nanomq

Lowjaylinyu · Publicado 2026-03-30 · Atualizado 2026-03-31 · CVE-2026-32696

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions NanoMQ versions prior to 0.24.7

Description NanoMQ MQTT Broker is an Edge Messaging Platform. When HTTP authentication is enabled (auth.http auth) in NanoMQ version 0.24.6, a client connecting via MQTT CONNECT without username/password, and with configuration parameters using placeholders %u and %P (e.g., username="%u", password="%P"), triggers a crash. This occurs because the set data() function in auth http.c calls strlen() on a NULL pointer, resulting in a SIGSEGV crash. This crash can be triggered remotely, leading to a denial of service.

Recommendations Upgrade to NanoMQ version 0.24.7 or later.

Exploit

Correção

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

CVE-2026-32696

GHSA-77F4-WVQ8-MP3P

Produtos afetados

Nanomq

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32696.json · Exploit
• https://github.com/nanomq/nanomq/security/advisories/GHSA-77f4-wvq8-mp3p · Aviso do Fabricante
• https://github.com/nanomq/nanomq/releases/tag/0.24.7 · Nota
• https://github.com/nanomq/NanoNNG/commit/c20aa27e5290bb480a5315099952480d35f37a8b · Correção
• https://github.com/nanomq/NanoNNG/pull/1394 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-32696 · Nota de Segurança
• https://twitter.com/CVEnew/status/2038916089418318296 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-32696 · Aviso do Fabricante