CVE-2026-34608
Out-of-Bounds Read in NanoMQ MQTT Broker JSON Parsing
Publication date: 2026-04-02
Last updated on: 2026-04-10
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| emqx | nanomq | to 0.24.10 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
| CWE-457 | The code uses a variable that has not been initialized, leading to unpredictable or unintended results. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-34608 is a moderate severity heap-buffer-overflow vulnerability in NanoMQ versions up to 0.24.x. It occurs in the webhook_inproc.c file within the hook_work_cb() function, which processes messages by parsing their body as JSON using cJSON_Parse(body). The message body is a binary buffer that is not guaranteed to be null-terminated, but cJSON_Parse expects a null-terminated string and reads until it finds a '\0'. This mismatch can cause cJSON_Parse to read beyond the allocated buffer, accessing adjacent memory such as message metadata or neighboring heap/stack memory, leading to an out-of-bounds read.
The issue is often masked by zero-padding added by the message allocator for certain message sizes, but when the JSON payload length is a power-of-two and at least 1024 bytes, no padding is added, reliably triggering the overflow. This vulnerability can cause crashes or potentially leak sensitive information.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in NanoMQ allows out-of-bounds reads that can potentially lead to information disclosure by reading adjacent memory, which may leak sensitive data through webhook logs.
Such information disclosure risks could impact compliance with data protection regulations like GDPR or HIPAA, which require safeguarding sensitive data against unauthorized access or leaks.
However, the CVE description and resources do not explicitly mention compliance impacts or specific regulatory considerations.
How can this vulnerability impact me? :
This vulnerability can impact you primarily by causing a remote Denial of Service (DoS) through broker crashes triggered by out-of-bounds reads and segmentation faults.
- Remote Denial of Service (DoS) due to broker crash.
- Potential information disclosure by reading adjacent memory, which may leak sensitive data through webhook logs.
- Theoretical possibility of heap corruption that could lead to more severe attacks, although this is considered low probability.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by triggering the heap-buffer-overflow condition using a JSON payload whose length is a power-of-two and at least 1024 bytes, which causes an out-of-bounds read in NanoMQ's webhook processing.
A practical detection method involves enabling the webhook in the nanomq.conf file with a specific URL and topic, compiling NanoMQ with AddressSanitizer (ASan) flags to detect memory errors, starting NanoMQ, and then running a proof-of-concept (PoC) script that sends a crafted payload designed to trigger the overflow.
Using AddressSanitizer during runtime will help identify the out-of-bounds read and segmentation faults caused by this vulnerability.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade NanoMQ to version 0.24.10 or later, where this vulnerability has been fixed.
The fix involves changing the JSON parsing in the webhook_inproc component to use length-aware parsing with cJSON_ParseWithLength(body, body_len), ensuring that the parser does not read beyond the allocated buffer.
If upgrading is not immediately possible, a workaround is to modify the code to create a null-terminated copy of the message body before parsing, preventing out-of-bounds reads.
Additionally, reviewing webhook and websocket configurations and applying any related security fixes from the 0.24.10 release can improve overall stability and security.