Description
NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In NanoMQ version 0.24.6, after enabling auth.http_auth (HTTP authentication), when a client connects to the broker using MQTT CONNECT without providing username/password, and the configuration params uses the placeholders %u / %P (e.g., username="%u", password="%P"), the HTTP request construction phase enters auth_http.c:set_data(). This results in calling strlen() on a NULL pointer, causing a SIGSEGV crash. This crash can be triggered remotely, resulting in a denial of service. This issue has been patched in version 0.24.7.
Published: 2026-03-30
Score: 3.1 Low
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service (process crash)
Action: Immediate Patch
AI Analysis

Impact

In NanoMQ version 0.24.6, enabling HTTP authentication and then connecting with the MQTT CONNECT command without supplying a username or password triggers a null pointer dereference in auth_http.c:set_data. The function calls strlen on a NULL pointer, causing the broker to receive a SIGSEGV and crash. This leads to a denial of service where the broker becomes unavailable to all clients. The weakness is a classic null pointer dereference (CWE‑476).

Affected Systems

The affected product is NanoMQ from the vendor nanomq. The vulnerability exists in version 0.24.6 and earlier, and a fix was introduced in version 0.24.7.

Risk and Exploitability

The CVSS score is 3.1, indicating a low severity. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. The attack can be performed over the network by any client that can communicate with the broker via MQTT, without requiring elevated privileges or prior authentication. The impact is limited to availability, giving an attacker the ability to disrupt the broker but not to compromise confidentiality or integrity.

Generated by OpenCVE AI on March 31, 2026 at 05:41 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade NanoMQ to version 0.24.7 or later.
  • Verify that the auth.http_auth configuration does not use placeholder strings like "%u" or "%P" when no credentials are supplied, or disable HTTP authentication if it is not needed.

Generated by OpenCVE AI on March 31, 2026 at 05:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 01 Apr 2026 02:15:00 +0000

Type Values Removed Values Added
First Time appeared Nanomq
Nanomq nanomq
Vendors & Products Nanomq
Nanomq nanomq

Tue, 31 Mar 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 31 Mar 2026 03:00:00 +0000

Type Values Removed Values Added
Description NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In NanoMQ version 0.24.6, after enabling auth.http_auth (HTTP authentication), when a client connects to the broker using MQTT CONNECT without providing username/password, and the configuration params uses the placeholders %u / %P (e.g., username="%u", password="%P"), the HTTP request construction phase enters auth_http.c:set_data(). This results in calling strlen() on a NULL pointer, causing a SIGSEGV crash. This crash can be triggered remotely, resulting in a denial of service. This issue has been patched in version 0.24.7.
Title NanoMQ HTTP Auth: Missing username/password can trigger a NULL-pointer strlen() in auth_http.c:set_data(), causing a process crash — SIGSEGV, remotely triggerable
Weaknesses CWE-476
References
Metrics cvssV3_1

{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L'}

Subscriptions

Nanomq Nanomq
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-03-31T15:24:06.506Z

Reserved: 2026-03-13T14:33:42.822Z

Link: CVE-2026-32696

cve-icon Vulnrichment

Updated: 2026-03-31T15:24:01.754Z

cve-icon NVD

Status : Undergoing Analysis

Published: 2026-03-30T21:17:09.603

Modified: 2026-04-01T14:24:02.583

Link: CVE-2026-32696

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-31T20:40:13Z

Weaknesses