CVE-2026-61633 Details
Description
NanoMQ is an MQTT broker. Prior to 0.24.14, the NanoMQ client function nni_mqtt_msg_decode_unsubscribe() in nng/src/supplemental/mqtt/mqtt_codec.c does not handle a failed read_uint16() while counting topics in a malformed UNSUBSCRIBE packet. A zero-length topic followed by trailing data can leave buf.curpos unchanged while topic_count continues to increase, allowing a malicious MQTT broker to hang a connecting MQTT 3.1.1 client, consume CPU and memory, and repeatedly deny service when automatic reconnection is enabled. The broker-side nmq_unsubinfo_decode path is not affected. This issue is fixed in version 0.24.14.
A denial-of-service vulnerability has been identified in NanoMQ, an MQTT broker, in versions prior to 0.24.14. The issue arises in the MQTT message decoding process, specifically within the UNSUBSCRIBE packet handling. The vulnerability occurs because the decoder does not properly manage errors when reading topic lengths from malformed packets. This oversight allows a malicious MQTT broker to create a zero-length topic followed by additional data, causing the client to enter an infinite loop. As the loop runs, it consumes excessive CPU and memory resources, effectively hanging the client process. This problem is exacerbated if the client has automatic reconnection enabled, as it will repeatedly attempt to connect and encounter the same issue.
Users are advised to upgrade to NanoMQ version 0.24.14 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 18, 2026CISA-ADP
Assessed Sep 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nanomq/nanomq/security/advisories/GHSA-m7mp-rr3v-hmhr | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/nanomq/nanomq/releases/tag/0.24.14 | [email protected] | Release NotesVendor |
| https://github.com/nanomq/nanomq/security/advisories/GHSA-m7mp-rr3v-hmhr | [email protected] | AdvisoryExploitRemedyVendor |
| https://github.com/nanomq/NanoNNG/commit/fa8d859bb39841e46cfc6cce280d242bd782ad3d | [email protected] | Source CodeVendor |
| https://github.com/nanomq/NanoNNG/pull/1518 | [email protected] | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-835 | Loop with Unreachable Exit Condition ('Infinite Loop') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NanoMQ | <= 0.24.11 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 18, 2026 | CVE Modified | CISA-ADP |
| Sep 18, 2026 | New CVE Received | [email protected] |