PT-2026-29123 · Nanomq · Nanomq

Lowjaylinyu · Published 2026-03-30 · Updated 2026-03-31 · CVE-2026-32696

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions NanoMQ versions prior to 0.24.7

Description NanoMQ MQTT Broker is an Edge Messaging Platform. When HTTP authentication is enabled (auth.http auth) in NanoMQ version 0.24.6, a client connecting via MQTT CONNECT without username/password, and with configuration parameters using placeholders %u and %P (e.g., username="%u", password="%P"), triggers a crash. This occurs because the set data() function in auth http.c calls strlen() on a NULL pointer, resulting in a SIGSEGV crash. This crash can be triggered remotely, leading to a denial of service.

Recommendations Upgrade to NanoMQ version 0.24.7 or later.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2026-32696

GHSA-77F4-WVQ8-MP3P

Affected Products

Nanomq

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32696.json · Exploit
• https://github.com/nanomq/nanomq/security/advisories/GHSA-77f4-wvq8-mp3p · Vendor Advisory
• https://github.com/nanomq/NanoNNG/commit/c20aa27e5290bb480a5315099952480d35f37a8b · Patch
• https://github.com/nanomq/NanoNNG/pull/1394 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-32696 · Security Note
• https://osv.dev/vulnerability/CVE-2026-32696 · Vendor Advisory
• https://github.com/nanomq/nanomq/releases/tag/0.24.7 · Note
• https://twitter.com/CVEnew/status/2038916089418318296 · Twitter Post