PT-2026-41984 · Nanomq · Nanomq

Published 2026-05-19 · Updated 2026-05-19 · CVE-2026-32134

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions NanoMQ versions prior to 0.24.11

Description A NULL pointer dereference can occur when the broker handles high-concurrency reconnect traffic using a reconnect-collision payload during MQTT session resumption for clients with clean start=0. The tcptran pipe peer() function iterates cpipe->subinfol while copying session metadata from a cached old pipe to a new reconnecting pipe without verifying if the pointer is NULL. In a reconnect race condition, cpipe->subinfol may be freed and set to NULL before session restore, leading to a remote unauthenticated Denial-of-Service through a process crash.

Recommendations Update to version 0.24.11.

Exploit

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2026-32134

Affected Products

Nanomq

References · 8

• 🔥 https://github.com/nanomq/nanomq/security/advisories/GHSA-q36f-83mh-pcv2 · Exploit
• 🔥 https://github.com/nanomq/nanomq/issues/2241 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-32134 · Security Note
• https://github.com/nanomq/nanomq/releases/tag/0.24.11 · Note
• https://github.com/nanomq/NanoNNG/commit/522ec62e29e60d1122f2aedaa6e702dcf089f7bb · Note
• https://t.me/CVEtracker/54270 · Telegram Post
• https://twitter.com/CVEnew/status/2056870203783270736 · Twitter Post
• https://t.me/cveNotify/164116 · Telegram Post