CVE-2026-32134 Details
Description
NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In versions 0.24.10 and below, when NanoMQ handles high-concurrency reconnect traffic using a reconnect-collision payload, the broker can crash due to a NULL pointer dereference during MQTT session resumption for clean_start=0 clients. The transport's p_peer callback (tcptran_pipe_peer()) iterates cpipe->subinfol while copying session metadata from the cached old pipe to the new reconnecting pipe, without checking whether the pointer is NULL. Under a reconnect race, cpipe->subinfol can be freed and set to NULL before session restore invokes this function, resulting in a remote unauthenticated Denial-of-Service (process crash) condition. This issue has been fixed in version 0.24.11.
A denial-of-service vulnerability has been identified in NanoMQ MQTT Broker versions through 0.24.10. When the broker experiences high-concurrency reconnect traffic with a reconnect-collision payload, it can crash due to a NULL pointer dereference. This issue arises during the MQTT session resumption for clients with clean_start set to 0. The problem occurs because the transport's p_peer callback iterates over a subscription information list without checking for NULL pointers. Under certain conditions, this can lead to a process crash.
Users can upgrade to NanoMQ version 0.24.11, which addresses the vulnerability by adding the necessary NULL checks in the transport peer callback functions.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 19, 2026CISA-ADP
Assessed May 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nanomq/nanomq/issues/2241 | CISA-ADP | ExploitIssue TrackingTechnical AnalysisVendor |
| https://github.com/nanomq/nanomq/security/advisories/GHSA-q36f-83mh-pcv2 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/nanomq/nanomq/issues/2241 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://github.com/nanomq/nanomq/releases/tag/0.24.11 | [email protected] | Release NotesVendor |
| https://github.com/nanomq/nanomq/security/advisories/GHSA-q36f-83mh-pcv2 | [email protected] | AdvisoryExploitRemedyVendor |
| https://github.com/nanomq/NanoNNG/commit/522ec62e29e60d1122f2aedaa6e702dcf089f7bb | [email protected] | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NanoMQ | <= 0.24.10 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 19, 2026 | CVE Modified | CISA-ADP |
| May 19, 2026 | New CVE Received | [email protected] |