CVE-2026-36590 Details

A denial-of-service vulnerability has been identified in EMQ NanoMQ version 0.24.9. The issue arises when NanoMQ is built without SQLite support, yet the configuration file enables SQLite persistence. This mismatch leads to a null pointer in the Quality of Service (QoS) database, causing the `nni_qos_db_set` function to return prematurely without releasing message references. As a result, repeated MQTT PUBLISH messages with QoS greater than zero can accumulate, causing excessive memory consumption and eventually crashing the broker.

Users are advised to restrict access to NanoMQ instances, avoid exposing MQTT services to untrusted clients, and ensure that SQLite persistence is not enabled in builds without SQLite support. The NanoMQ development team should also implement startup validation for SQLite configuration and modify the `nni_qos_db_set` function to release message references when the database pointer is null.