PT-2026-61654 · Nanomq · Nanomq

CVE-2026-47275 · Published 2026-07-20 · Updated 2026-07-20

Positive Technologies (AI Summary)

CVSS v3.1

2.6

Low

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions NanoMQ versions prior to 0.24.12

Description A NULL pointer dereference in the nni mqttv5 msg decode connect() function allows a malicious MQTT broker to crash any connecting NanoMQ MQTTv5 client, including those in bridge mode, causing a remote denial of service via SIGSEGV (a segmentation fault occurring when a program attempts to access a memory location it is not allowed to). The issue occurs in mqtt codec.c:1863 where the code incorrectly iterates over CONNECT properties using the prop variable instead of will prop. If a CONNECT packet contains will properties (will prop != NULL) but lacks connect-level properties (prop == NULL), dereferencing prop->next triggers the crash. This affects nanomq cli and NanoMQ bridge mode, potentially leading to a persistent denial of service if auto-reconnect triggers an infinite crash loop.

Recommendations Update to a version newer than 0.24.11.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2026-47275

GHSA-52QR-3V49-WMX6

Affected Products

Nanomq

References · 4

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47275.json · Exploit
• 🔥 https://github.com/nanomq/nanomq/security/advisories/GHSA-52qr-3v49-wmx6 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-47275 · Security Note
• https://osv.dev/vulnerability/CVE-2026-47275 · Vendor Advisory