CVE-2026-44639lowCWE-407

CVE-2026-44639: low-severity vulnerability in nanomq

NanoMQ: O(N²) Denial of Service in MQTT v5 Property Parsing

Published

Follow this CVE+ Monitor nanomq

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 3.7epss 0.4%
NanoMQ is an MQTT broker. Prior to 0.24.14, NanoMQ's MQTT v5 property decoder in nng/src/supplemental/mqtt/mqtt_codec.c uses property_append() to walk the entire linked list for each property added by decode_buf_properties(). A remote unauthenticated client can supply a PUBLISH or SUBSCRIBE packet containing many User Properties, causing O(N²) linked-list insertion and CPU work that makes the broker unresponsive; repeated packets can sustain the denial of service. This issue is fixed in version 0.24.14.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
nanomq · nanomq
Related CVEs — nanomq

In the same product, most dangerous first.

CVE-2026-32135HIGHNanoMQ has Heap Buffer Overflow in URI Parameter ParsingEPSS 0.5%CVE-2026-25627MEDIUMnanomq: OOB Read / Crash (DoS) via Malformed MQTT Remaining Length over WebSocketEPSS 0.5%CVE-2026-32696LOWNanoMQ HTTP Auth: Missing username/password can trigger a NULL-pointer strlen() in auth_http.c:set_data(), causing a process crash — SIGSEGV, remotely triggerableEPSS 0.4%CVE-2026-47276MEDIUMNULL Pointer Dereference in REST API properties_parse via Malformed user_propertiesEPSS 0.4%CVE-2026-32134MEDIUMNanoMQ: NULL Pointer Dereference Crash in tcptran_pipe_peer During Session RestoreEPSS 0.4%CVE-2025-59946HIGHNanoMQ has a Use After Free vulnerability via sub info listEPSS 0.4%