PT-2025-51314 · Nanomq · Nanomq

Published 2025-12-15 · Updated 2025-12-21 · CVE-2025-59947

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NanoMQ versions prior to 0.24.4

Description NanoMQ is a messaging broker/bus designed for IoT Edge and SDV environments. A buffer overflow can occur when processing PUBLISH packets that trigger both shared and standard subscriptions. This issue impacts versions prior to 0.24.4. As a temporary measure, disabling shared subscriptions can mitigate the risk.

Recommendations Update to version 0.24.4 or later. Disable shared subscriptions as a workaround for versions prior to 0.24.4.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2025-59947

GHSA-98F4-CMG8-X7F3

Affected Products

Nanomq

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59947.json · Exploit
• https://github.com/nanomq/nanomq/commit/5f5581054bb92f102cf99251e8af2f43763d457b · Patch
• https://github.com/nanomq/nanomq/issues/2110 · Patch
• https://github.com/nanomq/nanomq/security/advisories/GHSA-98f4-cmg8-x7f3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-59947 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59947 · Security Note
• https://twitter.com/VulmonFeeds/status/2000699709850030176 · Twitter Post
• https://twitter.com/CVEnew/status/2002857382469398777 · Twitter Post