PT-2025-48097 · Nanomq+1 · Nanomq+1

Published 2025-11-25 · Updated 2025-11-26 · CVE-2025-65953

Positive Technologies (AI Summary)

CVSS v4.0

6.0

Medium

Base vector

AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions NanoMQ versions prior to 0.22.5

Description A Heap-Use-After-Free (UAF) vulnerability exists in the TCP transport component of NanoMQ, stemming from improper resource management and premature cleanup of message and pipe structures. This occurs under specific conditions involving malformed MQTTV5 retain message traffic. The vulnerability is located in src/sp/transport/mqtt/broker tcp.c and relies on the NanoNNG library.

Recommendations Update to version 0.22.5 or later.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2025-65953

GHSA-R95P-WJM8-2QXR

Affected Products

Nanomq

Nanonng

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65953.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-65953 · Security Note
• https://osv.dev/vulnerability/CVE-2025-65953 · Vendor Advisory
• https://github.com/nanomq/nanomq/security/advisories/GHSA-r95p-wjm8-2qxr · Note
• https://twitter.com/CVEnew/status/1993462756465406148 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1993583644997304520 · Twitter Post