CVE-2026-25627

NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to version 0.24.8, NanoMQ’s MQTT-over-WebSocket transport can be crashed by sending an MQTT packet with a deliberately large Remaining Length in the fixed header while providing a much shorter actual payload. The code path copies Remaining Length bytes without verifying that the current receive buffer contains that many bytes, resulting in an out-of-bounds read (ASAN reports OOB / crash). This is remotely triggerable over the WebSocket listener. This issue has been patched in version 0.24.8.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/nanomq/NanoNNG/commit/e80b30bad6d855593a68d18f2785bfaca6faf09e	Patch
https://github.com/nanomq/NanoNNG/pull/1405	Issue Tracking Patch
https://github.com/nanomq/nanomq/releases/tag/0.24.8	Release Notes
https://github.com/nanomq/nanomq/security/advisories/GHSA-w4rh-v3h2-j29x	Exploit Vendor Advisory
https://github.com/nanomq/nanomq/security/advisories/GHSA-w4rh-v3h2-j29x	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:emqx:nanomq:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-03-30 21:17

Updated : 2026-06-17 10:24

NVD link : CVE-2026-25627

Mitre link : CVE-2026-25627

CVE.ORG link : CVE-2026-25627

JSON object : View

Products Affected

emqx

nanomq

CWE

CWE-125

Out-of-bounds Read

{"id": "CVE-2026-25627", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25627", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-31T18:38:44.968276Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "nanomq", "product": "nanomq", "versions": [{"status": "affected", "version": "< 0.24.8"}]}]}], "published": "2026-03-30T21:17:07.750", "references": [{"url": "https://github.com/nanomq/NanoNNG/commit/e80b30bad6d855593a68d18f2785bfaca6faf09e", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nanomq/NanoNNG/pull/1405", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nanomq/nanomq/releases/tag/0.24.8", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nanomq/nanomq/security/advisories/GHSA-w4rh-v3h2-j29x", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nanomq/nanomq/security/advisories/GHSA-w4rh-v3h2-j29x", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to version 0.24.8, NanoMQ\u2019s MQTT-over-WebSocket transport can be crashed by sending an MQTT packet with a deliberately large Remaining Length in the fixed header while providing a much shorter actual payload. The code path copies Remaining Length bytes without verifying that the current receive buffer contains that many bytes, resulting in an out-of-bounds read (ASAN reports OOB / crash). This is remotely triggerable over the WebSocket listener. This issue has been patched in version 0.24.8."}, {"lang": "es", "value": "NanoMQ MQTT Broker (NanoMQ) es una plataforma de mensajer\u00eda de borde integral. Antes de la versi\u00f3n 0.24.8, el transporte MQTT-over-WebSocket de NanoMQ puede colapsar al enviar un paquete MQTT con una longitud restante (Remaining Length) deliberadamente grande en la cabecera fija mientras se proporciona una carga \u00fatil real mucho m\u00e1s corta. La ruta del c\u00f3digo copia bytes de la longitud restante sin verificar que el b\u00fafer de recepci\u00f3n actual contenga esa cantidad de bytes, lo que resulta en una lectura fuera de l\u00edmites (ASAN informa OOB / fallo). Esto puede ser activado remotamente a trav\u00e9s del oyente de WebSocket. Este problema ha sido parcheado en la versi\u00f3n 0.24.8."}], "lastModified": "2026-06-17T10:24:58.583", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:emqx:nanomq:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5BCF33DD-E338-4F9C-BA28-CC3F585079AF", "versionEndExcluding": "0.24.8"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}