NanoMQ MQTT Broker versions 0.24.8 and earlier contain a null pointer dereference in the quic_stream_recv function. When a substream is in a reopen state, the function may dereference a null substream pointer. This flaw causes the broker to crash or become unstable, resulting in a denial of service to clients that rely on the broker for messaging. The vulnerability does not provide a direct path to remote code execution but can be exploited to disrupt broker availability.

The affected product is NanoMQ, an MQTT broker designed for edge messaging. All releases up through 0.24.8 are impacted. Versions newer than 0.24.8 are not affected according to the advisory.

The CVSS score of 2.9 indicates low severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Attacks would likely require the ability to trigger a substream reopen state, possibly through crafted MQTT traffic over the QUIC protocol. The impact is confined to a crash or service interruption, and exploitation would be easier in environments where the broker is accessible to uncontrolled clients.