Description
NanoMQ contains a protocol-semantics flaw in its MQTT v5 `SUBSCRIBE` handling: if a subscription entry is missing the final 1-byte `Subscription Options` field, the broker may still accept the malformed packet and install the subscription into internal broker state. Under a specific packet-length construction, the same parser flaw also causes a 1-byte out-of-bounds read that crosses the real heap allocation boundary and is detected by ASAN as a `heap-buffer-overflow`.

If the consumed byte happens to look acceptable, NanoMQ may continue and append the malformed subscription entry into its internal `subinfol` state. In that case, a `SUBSCRIBE` packet that should be rejected by MQTT rules is instead treated as a successful subscription. Whether ASAN reports the bug does not depend on MQTT's logical `remain` boundary; it depends on whether the read crosses the real heap allocation boundary of the underlying message buffer. In other words, these are not two unrelated issues. They are two manifestations of the same parsing defect: by default, it appears as a semantic vulnerability, and under suitable input conditions, it also becomes a verifiable out-of-bounds read vulnerability.
Published: 2026-07-20
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

NanoMQ’s MQTT v5 SUBSCRIBE handler contains a parsing defect that accepts malformed packets missing the final Subscription Options byte. When processed, the broker may install the subscription into its internal state, effectively granting an unauthorized subscription. With a carefully constructed packet length, the same flaw triggers a one‑byte out‑of‑bounds read that crosses the heap allocation boundary, which is detected by AddressSanitizer as a heap‑buffer‑overflow. The vulnerability is a semantic violation tied to the same parsing issue and could lead to broker instability, crash, or unintended disclosure of internal data.

Affected Systems

The affected product is NanoMQ, released by the nanomq:nanomq CNA. No specific version numbers are provided in the advisory, so all releases that have not incorporated the patch are considered vulnerable.

Risk and Exploitability

The CVSS score of 6.5 denotes medium severity. The EPSS score is < 1%, indicating a very low but non‑zero likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The flaw can be triggered over the network by sending a crafted MQTT SUBSCRIBE packet. While the vulnerability requires some packet‑length manipulation, it does not need local access and could be used to disrupt broker operation or, in the out‑of‑bounds read scenario, cause a crash or information leak.

Generated by OpenCVE AI on July 30, 2026 at 19:00 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade NanoMQ to the latest release that contains the fixed SUBSCRIBE parsing logic.
  • If an upgrade is not immediately feasible, enable or configure strict MQTT validation to reject SUBSCRIBE packets that do not include the required Subscription Options byte, thereby preventing the malformed packets from reaching the broker’s internal state.
  • Audit broker logs for unexpected SUBSCRIBE traffic and investigate any anomalies, applying network filtering if necessary to block crafted packets.

Generated by OpenCVE AI on July 30, 2026 at 19:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 20 Jul 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Nanomq
Nanomq nanomq
Vendors & Products Nanomq
Nanomq nanomq

Mon, 20 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 20 Jul 2026 17:15:00 +0000

Type Values Removed Values Added
Description NanoMQ contains a protocol-semantics flaw in its MQTT v5 `SUBSCRIBE` handling: if a subscription entry is missing the final 1-byte `Subscription Options` field, the broker may still accept the malformed packet and install the subscription into internal broker state. Under a specific packet-length construction, the same parser flaw also causes a 1-byte out-of-bounds read that crosses the real heap allocation boundary and is detected by ASAN as a `heap-buffer-overflow`. If the consumed byte happens to look acceptable, NanoMQ may continue and append the malformed subscription entry into its internal `subinfol` state. In that case, a `SUBSCRIBE` packet that should be rejected by MQTT rules is instead treated as a successful subscription. Whether ASAN reports the bug does not depend on MQTT's logical `remain` boundary; it depends on whether the read crosses the real heap allocation boundary of the underlying message buffer. In other words, these are not two unrelated issues. They are two manifestations of the same parsing defect: by default, it appears as a semantic vulnerability, and under suitable input conditions, it also becomes a verifiable out-of-bounds read vulnerability.
Title NanoMQ Incorrectly Accepts a Malformed SUBSCRIBE and Can Be Driven into an ASAN-Detectable Out-of-Bounds Read
Weaknesses CWE-125
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H'}

Subscriptions

Nanomq Nanomq
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-20T17:53:52.495Z

Reserved: 2026-04-01T18:48:58.938Z

Link: CVE-2026-35217

cve-icon Vulnrichment

Updated: 2026-07-20T17:53:22.957Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-30T19:15:04Z

Weaknesses