CVE-2026-32696 Details
Description
NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In NanoMQ version 0.24.6, after enabling auth.http_auth (HTTP authentication), when a client connects to the broker using MQTT CONNECT without providing username/password, and the configuration params uses the placeholders %u / %P (e.g., username="%u", password="%P"), the HTTP request construction phase enters auth_http.c:set_data(). This results in calling strlen() on a NULL pointer, causing a SIGSEGV crash. This crash can be triggered remotely, resulting in a denial of service. This issue has been patched in version 0.24.7.
A denial-of-service vulnerability has been identified in NanoMQ MQTT Broker version 0.24.6. When HTTP authentication is enabled, and a client connects without providing a username or password, the broker crashes. This occurs because the authentication configuration uses placeholders for username and password, leading to a NULL pointer dereference. The vulnerability can be exploited remotely, causing a segmentation fault and crashing the broker process.
Users can upgrade to NanoMQ version 0.24.7, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nanomq/nanomq/releases/tag/0.24.7 | [email protected] | ProductRelease Notes |
| https://github.com/nanomq/nanomq/security/advisories/GHSA-77f4-wvq8-mp3p | [email protected] | ExploitVendor Advisory |
| https://github.com/nanomq/NanoNNG/commit/c20aa27e5290bb480a5315099952480d35f37a8b | [email protected] | Patch |
| https://github.com/nanomq/NanoNNG/pull/1394 | [email protected] | Issue TrackingPatch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| emqx nanomq | < 0.24.7 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 13, 2026 | Initial Analysis | [email protected] |
| Mar 30, 2026 | New CVE Received | [email protected] |