PT-2026-5967 · Nanomq · Nanomq

Published 2026-02-04 · Updated 2026-02-04 · CVE-2025-68699

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions NanoMQ versions prior to 0.24.7

Description NanoMQ MQTT Broker (NanoMQ) has an issue related to protocol parsing and forwarding when handling shared subscriptions ($share/). A malformed SUBSCRIBE topic, such as $share/ab (missing the second /), is not properly validated during subscription. This invalid Topic Filter is stored, and when a PUBLISH message matches this subscription, the nmq pipe send start v4/v5 function attempts to parse the topic using strchr(). If strchr() returns NULL, the code increments a pointer to an invalid address. This invalid pointer is then passed to the topic filtern() function, which causes a crash due to a strlen() call, resulting in a SIGSEGV. The crash is reliably triggered remotely. The vulnerable code involves the parsing of shared subscription topics and the use of pointer arithmetic without proper NULL checks.

Recommendations Upgrade to NanoMQ version 0.24.7 or later to address this issue.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2025-68699

GHSA-QV5F-C6V2-2F8H

Affected Products

Nanomq

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68699.json · Exploit
• https://github.com/nanomq/nanomq/security/advisories/GHSA-qv5f-c6v2-2f8h · Vendor Advisory
• https://github.com/nanomq/nanomq/commit/89d68d678e7f841ae7baa45cba8d9bc7ddc9ef4b · Patch
• https://osv.dev/vulnerability/CVE-2025-68699 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68699 · Security Note
• https://twitter.com/CVEnew/status/2019137046485344424 · Twitter Post