CVE-2026-44640 Details
Description
NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to 0.24.14, aio->prov_data is stored as nni_quic_conn* during dialing, but read as ex_quic_conn* during dialer close. This type confusion causes invalid object interpretation and leads to close-path hang/crash behavior. This vulnerability is fixed in 0.24.14.
A type confusion vulnerability has been identified in NanoMQ MQTT Broker versions prior to 0.24.14. During the dialing process, the asynchronous input/output operation's provisional data is incorrectly stored as a pointer to a QUIC connection, but is read as a pointer to an exclusive QUIC connection when closing the dialer. This mismatch leads to improper interpretation of the object, causing the process to hang or crash. The issue can be reproduced by allocating an asynchronous operation, dialing a stream using a dialer, and then closing the dialer while the operation is still pending, which triggers the type confusion and results in a hang due to the incorrect object interpretation.
Users are advised to upgrade to NanoMQ version 0.24.14 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 29, 2026CISA-ADP
Assessed May 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nanomq/nanomq/security/advisories/GHSA-9fgw-v323-jmjj | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/nanomq/nanomq/releases/tag/0.24.14 | [email protected] | Release NotesVendor |
| https://github.com/nanomq/nanomq/security/advisories/GHSA-9fgw-v323-jmjj | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-843 | Access of Resource Using Incompatible Type ('Type Confusion') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NanoMQ | <= 0.24.x |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 29, 2026 | CVE Modified | CISA-ADP |
| May 29, 2026 | New CVE Received | [email protected] |