Description
An issue in EMQ NanoMQ v.0.24.9 allows a remote attacker to cause a denial of service via the nni_qos_db_set function in broker_tcp.c component
Published: 2026-07-15
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An issue in EMQ NanoMQ version 0.24.9 permits a remote attacker to trigger a denial of service by invoking the nni_qos_db_set function in broker_tcp.c. The flaw maps to CWE-400 Uncontrolled Resource Consumption and CWE-772 Improper Release of Resources, indicating that the broker can become unresponsive after receiving malformed input.

Affected Systems

EMQ NanoMQ version 0.24.9. No vendor name is specified in the data, but the referenced repository indicates that the project is developed by EMQ.

Risk and Exploitability

The CVSS score of 7.5 places the vulnerability in the high severity range, while the EPSS score of <1% indicates a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote network connection that reaches the EMQ NanoMQ broker and invokes the vulnerable function; no special privileges beyond network reachability to the broker are required.

Generated by OpenCVE AI on August 1, 2026 at 09:04 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply an updated EMQ NanoMQ version that corrects the nni_qos_db_set implementation.
  • Restrict network access to the EMQ NanoMQ broker by configuring firewall rules or network segmentation, limiting connections to trusted hosts.
  • broker logs and performance metrics for signs of resource exhaustion or unexpected service interruptions, and restart or redeploy when a denial of service is detected.

Generated by OpenCVE AI on August 1, 2026 at 09:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 01 Aug 2026 09:30:00 +0000

Type Values Removed Values Added
Title Remote Denial of Service via nni_qos_db_set in EMQ NanoMQ

Thu, 30 Jul 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Emqx
Emqx nanomq
Vendors & Products Emqx
Emqx nanomq

Tue, 28 Jul 2026 04:00:00 +0000

Type Values Removed Values Added
Title Remote Denial of Service via nni_qos_db_set in EMQ NanoMQ

Wed, 22 Jul 2026 08:00:00 +0000

Type Values Removed Values Added
Title Remote Denial of Service in EMQ NanoMQ via nni_qos_db_set

Fri, 17 Jul 2026 17:15:00 +0000

Type Values Removed Values Added
Title Remote Denial of Service in EMQ NanoMQ via nni_qos_db_set

Thu, 16 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400
CWE-772
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 15 Jul 2026 22:15:00 +0000

Type Values Removed Values Added
Description An issue in EMQ NanoMQ v.0.24.9 allows a remote attacker to cause a denial of service via the nni_qos_db_set function in broker_tcp.c component
References

Subscriptions

Emqx Nanomq
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-07-16T19:00:21.614Z

Reserved: 2026-04-06T00:00:00.000Z

Link: CVE-2026-36590

cve-icon Vulnrichment

Updated: 2026-07-16T18:55:36.844Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-01T09:15:03Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-772

    Missing Release of Resource after Effective Lifetime