Nanomq
by Emqx
Source repositories
CVEs (40)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-42655 | Hig | 0.57 | 8.8 | 0.00 | Jul 29, 2025 | An access control issue in NanoMQ v0.21.10 allows attackers to bypass security restrictions and access sensitive system topic messages using MQTT wildcard characters. | ||
| CVE-2023-34488 | Hig | 0.51 | 7.8 | 0.01 | Jun 12, 2023 | NanoMQ 0.17.5 has a one-byte heap-based buffer over-read in the conn_handler function of mqtt_parser.c when it processes malformed messages. | ||
| CVE-2026-21888 | Hig | 0.49 | 7.5 | 0.00 | Mar 11, 2026 | NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. MQTT v5 Variable Byte Integer parsing out-of-bounds: get_var_integer() accepts 5-byte varints without bounds checks; reliably triggers OOB read / crash when built with ASan. This affects 0.24.6 and earlier. | ||
| CVE-2024-48077 | Hig | 0.49 | 7.5 | 0.00 | Jan 15, 2026 | NanoMQ v0.22.7 is vulnerable to Denial of Service (DoS) due to improper resource throttling. A crafted sequence of requests causes the recv-q queue to saturate, leading to the rapid exhaustion of system file descriptors (FDs). This exhaustion triggers a process crash, rendering… | ||
| CVE-2025-59946 | Hig | 0.49 | 7.5 | 0.00 | Dec 27, 2025 | NanoMQ MQTT Broker (NanoMQ) is an Edge Messaging Platform. Prior to version 0.24.2, there is a classical data racing issue about sub info list which could result in heap use after free crash. This issue has been patched in version 0.24.2. | ||
| CVE-2024-42651 | Hig | 0.49 | 7.5 | 0.00 | Jul 29, 2025 | NanoMQ v0.17.9 was discovered to contain a heap use-after-free vulnerability via the component sub_Ctx_handle. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted SUBSCRIBE message. | ||
| CVE-2024-42646 | Hig | 0.49 | 7.5 | 0.00 | Jul 14, 2025 | A segmentation fault in NanoMQ v0.21.10 allows attackers to cause a Denial of Service (DoS) via crafted messages. | ||
| CVE-2024-44460 | Hig | 0.49 | 7.5 | 0.00 | Sep 12, 2024 | An invalid read size in Nanomq v0.21.9 allows attackers to cause a Denial of Service (DoS). | ||
| CVE-2024-31041 | Hig | 0.49 | 7.5 | 0.01 | Apr 17, 2024 | Null Pointer Dereference vulnerability in topic_filtern function in mqtt_parser.c in NanoMQ 0.21.7 allows attackers to cause a denial of service. | ||
| CVE-2023-34494 | Hig | 0.49 | 7.5 | 0.01 | Jun 12, 2023 | NanoMQ 0.16.5 is vulnerable to heap-use-after-free in the nano_ctx_send function of nmq_mqtt.c. | ||
| CVE-2023-29996 | Hig | 0.49 | 7.5 | 0.01 | May 4, 2023 | In NanoMQ v0.15.0-0, segment fault with Null Pointer Dereference occurs in the process of decoding subinfo_decode and unsubinfo_decode. | ||
| CVE-2023-29995 | Hig | 0.49 | 7.5 | 0.01 | May 4, 2023 | In NanoMQ v0.15.0-0, a Heap overflow occurs in copyn_utf8_str function of mqtt_parser.c | ||
| CVE-2023-29994 | Hig | 0.49 | 7.5 | 0.01 | May 4, 2023 | In NanoMQ v0.15.0-0, Heap overflow occurs in read_byte function of mqtt_code.c. | ||
| CVE-2024-31036 | Med | 0.44 | 6.8 | 0.00 | Apr 22, 2024 | A heap-buffer-overflow vulnerability in the read_byte function in NanoMQ v.0.21.7 allows attackers to cause a denial of service via transmission of crafted hexstreams. | ||
| CVE-2026-32135 | Hig | 0.42 | 7.5 | 0.01 | Apr 20, 2026 | NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Versions prior to 0.24.11 have a remotely triggerable heap buffer overflow in the `uri_param_parse` function of NanoMQ's REST API. The vulnerability occurs due to an off-by-one error when allocating memory for… | ||
| CVE-2024-42649 | Med | 0.42 | 6.5 | 0.00 | Jul 14, 2025 | NanoMQ v0.22.10 was discovered to contain a memory leak which allows attackers to cause a Denial of Service (DoS) via a crafted PUBLISH message. | ||
| CVE-2024-42648 | Med | 0.42 | 6.5 | 0.00 | Jul 14, 2025 | NanoMQ v0.22.10 was discovered to contain a heap overflow which allows attackers to cause a Denial of Service (DoS) via a crafted CONNECT message. | ||
| CVE-2024-25767 | Med | 0.42 | 6.5 | 0.01 | Feb 26, 2024 | nanomq 0.21.2 contains a Use-After-Free vulnerability in /nanomq/nng/src/core/socket.c. | ||
| CVE-2025-65953 | Med | 0.39 | — | 0.00 | Nov 25, 2025 | NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to version 0.22.5, a Heap-Use-After-Free (UAF) vulnerability exists in the TCP transport component of NanoMQ, which relies on the underlying NanoNNG library (specifically in… | ||
| CVE-2023-33656 | Med | 0.36 | 5.5 | 0.00 | May 30, 2023 | A memory leak vulnerability exists in NanoMQ 0.17.2. The vulnerability is located in the file message.c. An attacker could exploit this vulnerability to cause a denial of service attack by causing the program to consume all available memory resources. |
- risk 0.57cvss 8.8epss 0.00
An access control issue in NanoMQ v0.21.10 allows attackers to bypass security restrictions and access sensitive system topic messages using MQTT wildcard characters.
- risk 0.51cvss 7.8epss 0.01
NanoMQ 0.17.5 has a one-byte heap-based buffer over-read in the conn_handler function of mqtt_parser.c when it processes malformed messages.
- risk 0.49cvss 7.5epss 0.00
NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. MQTT v5 Variable Byte Integer parsing out-of-bounds: get_var_integer() accepts 5-byte varints without bounds checks; reliably triggers OOB read / crash when built with ASan. This affects 0.24.6 and earlier.
- risk 0.49cvss 7.5epss 0.00
NanoMQ v0.22.7 is vulnerable to Denial of Service (DoS) due to improper resource throttling. A crafted sequence of requests causes the recv-q queue to saturate, leading to the rapid exhaustion of system file descriptors (FDs). This exhaustion triggers a process crash, rendering…
- risk 0.49cvss 7.5epss 0.00
NanoMQ MQTT Broker (NanoMQ) is an Edge Messaging Platform. Prior to version 0.24.2, there is a classical data racing issue about sub info list which could result in heap use after free crash. This issue has been patched in version 0.24.2.
- risk 0.49cvss 7.5epss 0.00
NanoMQ v0.17.9 was discovered to contain a heap use-after-free vulnerability via the component sub_Ctx_handle. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted SUBSCRIBE message.
- risk 0.49cvss 7.5epss 0.00
A segmentation fault in NanoMQ v0.21.10 allows attackers to cause a Denial of Service (DoS) via crafted messages.
- risk 0.49cvss 7.5epss 0.00
An invalid read size in Nanomq v0.21.9 allows attackers to cause a Denial of Service (DoS).
- risk 0.49cvss 7.5epss 0.01
Null Pointer Dereference vulnerability in topic_filtern function in mqtt_parser.c in NanoMQ 0.21.7 allows attackers to cause a denial of service.
- risk 0.49cvss 7.5epss 0.01
NanoMQ 0.16.5 is vulnerable to heap-use-after-free in the nano_ctx_send function of nmq_mqtt.c.
- risk 0.49cvss 7.5epss 0.01
In NanoMQ v0.15.0-0, segment fault with Null Pointer Dereference occurs in the process of decoding subinfo_decode and unsubinfo_decode.
- risk 0.49cvss 7.5epss 0.01
In NanoMQ v0.15.0-0, a Heap overflow occurs in copyn_utf8_str function of mqtt_parser.c
- risk 0.49cvss 7.5epss 0.01
In NanoMQ v0.15.0-0, Heap overflow occurs in read_byte function of mqtt_code.c.
- risk 0.44cvss 6.8epss 0.00
A heap-buffer-overflow vulnerability in the read_byte function in NanoMQ v.0.21.7 allows attackers to cause a denial of service via transmission of crafted hexstreams.
- risk 0.42cvss 7.5epss 0.01
NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Versions prior to 0.24.11 have a remotely triggerable heap buffer overflow in the `uri_param_parse` function of NanoMQ's REST API. The vulnerability occurs due to an off-by-one error when allocating memory for…
- risk 0.42cvss 6.5epss 0.00
NanoMQ v0.22.10 was discovered to contain a memory leak which allows attackers to cause a Denial of Service (DoS) via a crafted PUBLISH message.
- risk 0.42cvss 6.5epss 0.00
NanoMQ v0.22.10 was discovered to contain a heap overflow which allows attackers to cause a Denial of Service (DoS) via a crafted CONNECT message.
- risk 0.42cvss 6.5epss 0.01
nanomq 0.21.2 contains a Use-After-Free vulnerability in /nanomq/nng/src/core/socket.c.
- risk 0.39cvss —epss 0.00
NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to version 0.22.5, a Heap-Use-After-Free (UAF) vulnerability exists in the TCP transport component of NanoMQ, which relies on the underlying NanoNNG library (specifically in…
- risk 0.36cvss 5.5epss 0.00
A memory leak vulnerability exists in NanoMQ 0.17.2. The vulnerability is located in the file message.c. An attacker could exploit this vulnerability to cause a denial of service attack by causing the program to consume all available memory resources.
Page 1 of 2