CVE-2026-36590

Analyzed Analyzed - Analysis Complete

Denial of Service in EMQ NanoMQ

Publication date: 2026-07-15

Last updated on: 2026-07-16

Assigner: MITRE

Description

An issue in EMQ NanoMQ v.0.24.9 allows a remote attacker to cause a denial of service via the nni_qos_db_set function in broker_tcp.c component

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-16

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-04

NVD

CVE-2026-36590

EUVD

EUVD-2026-44847

Affected Vendors & Products

Vendor	Product	Version / Range
emqx	nanomq	0.24.9

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.
CWE-772	The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.

Attack-Flow Graph

Executive Summary

This vulnerability is a denial of service issue in EMQ NanoMQ version 0.24.9. It is caused by a flaw in the nni_qos_db_set function within the broker_tcp.c component, which can be exploited by a remote attacker.

Detection Guidance

Monitor NanoMQ process memory usage for abnormal growth during MQTT QoS > 0 PUBLISH traffic. Check logs for repeated crashes or high memory consumption. Use tools like 'top', 'htop', or 'ps' to track memory usage of the NanoMQ process. If SQLite is enabled but the build lacks support, memory leaks will occur during QoS message handling.

Impact Analysis

The vulnerability may allow an attacker to disrupt the availability of EMQ NanoMQ services by causing a denial of service. This could lead to service outages or degraded performance for systems relying on this software.

Compliance Impact

The provided CVE data does not specify how this vulnerability impacts compliance with standards like GDPR or HIPAA. The issue involves a denial of service in EMQ NanoMQ, but no details are given about data exposure, privacy risks, or regulatory implications.

Mitigation Strategies

Update EMQ NanoMQ to a version that patches the vulnerability in the nni_qos_db_set function in broker_tcp.c. If an update is not available, consider disabling affected components or restricting network access to vulnerable services.

Hi! I’m here to help you understand CVE-2026-36590. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70