CVE-2026-47275
Received Received - Intake

NULL Pointer Dereference in NanoMQ MQTTv5 Client

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description
In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in `nni_mqttv5_msg_decode_connect()` allows a malicious MQTT broker to crash any connecting NanoMQ MQTTv5 client (including bridge mode) with a single packet, causing remote denial of service via SIGSEGV. In `nni_mqttv5_msg_decode_connect()` (`mqtt_codec.c:1863`), the code iterates over CONNECT properties using variable `prop` when it should use `will_prop`. When a CONNECT packet has no connect-level properties (`prop == NULL`) but has will properties (`will_prop != NULL`), dereferencing `prop->next` causes SIGSEGV at address `0x38` (NULL + `offsetof(property, next)`). This affects both `nanomq_cli` and **NanoMQ bridge mode** (Core component), as both use the same `mqtt_client.c` receive path. This can lead to remote DoS if a malicious MQTT broker can crash the client process with a single 35-byte packet and persistent DoS if auto-reconnect causes infinite crash loop.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-47275
EUVD
EUVD-2026-46023

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
nanomq nanomq to 0.24.11 (exc)
nanomq nanomq_cli *
nanomq nanomq_bridge_mode *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a NULL pointer dereference in the MQTTv5 client CONNECT decoder of NanoMQ versions 0.24.11 and earlier. A malicious MQTT broker can crash any connecting NanoMQ MQTTv5 client by sending a single crafted CONNECT packet. The issue occurs in the function nni_mqttv5_msg_decode_connect() where the code incorrectly uses the prop variable instead of will_prop when iterating over CONNECT properties. When a CONNECT packet lacks connect-level properties but includes will properties, dereferencing prop->next causes a segmentation fault (SIGSEGV), leading to a remote denial of service (DoS).

Detection Guidance

Detecting this vulnerability requires monitoring for crashes in NanoMQ clients or bridge mode processes. Check system logs for SIGSEGV errors from nanomq or nanomq_cli processes. Use commands like 'journalctl -u nanomq' or 'dmesg | grep nanomq' to identify crashes. Monitor network traffic for malformed MQTTv5 CONNECT packets with will properties but no connect-level properties.

Impact Analysis

This vulnerability allows a malicious MQTT broker to crash your NanoMQ MQTTv5 client with a single packet, causing a denial of service. If your client is in bridge mode or uses auto-reconnect, the crash can become persistent, leading to repeated downtime and service interruptions.

Compliance Impact

This vulnerability could indirectly impact compliance with standards like GDPR or HIPAA by enabling denial-of-service attacks that disrupt availability of MQTT-based systems handling sensitive data. A crash loop from auto-reconnect could lead to prolonged downtime, potentially violating availability requirements in these regulations.

Mitigation Strategies

Immediate mitigation involves disabling MQTTv5 client functionality if possible, or restricting network access to prevent malicious brokers from connecting. Update to a patched version once available. If using bridge mode, consider switching to MQTTv3.1.1 or disabling auto-reconnect to prevent crash loops. Monitor affected systems closely for signs of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47275. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart