CVE-2026-97152 in Nanomsg
Summary
by MITRE • 09/24/2026
Nanomsg versions 0.5-beta through 1.x before 1.2.3 has a remotely exploitable buffer overflow in the WebSocket transport, due to an unchecked copy of the Sec-WebSocket-Version header, through snprintf.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability identified in Nanomsg versions ranging from 0.5-beta up to but not including version 1.2.3 represents a critical security flaw within its WebSocket transport layer implementation. This issue stems directly from improper input validation and boundary checking during the processing of HTTP upgrade requests, specifically concerning the Sec-WebSocket-Version header field. In standard WebSocket handshake procedures, clients send an initial HTTP request that includes various headers to negotiate protocol upgrades. The Nanomsg library, when acting as a server or handling incoming connections, parses these headers to establish communication channels. However, in the affected versions, the code responsible for copying and processing the Sec-WebSocket-Version header fails to verify the length of the input string before passing it to snprintf functions. This lack of bounds checking creates a classic buffer overflow condition where data exceeding the allocated stack or heap space is written into adjacent memory regions.
From a technical perspective, this flaw allows an attacker who can send network packets to the vulnerable Nanomsg endpoint to execute arbitrary code with the privileges of the running process. By crafting a malicious Sec-WebSocket-Version header containing a string significantly longer than expected by the application's internal buffers, an adversary can overwrite critical memory structures such as return addresses or function pointers on the stack. This overwriting capability enables remote code execution (RCE), which is one of the most severe outcomes in cybersecurity. The vulnerability falls under CWE-120, Buffer Copy without Checking Size of Input, and specifically relates to CWE-787 Out-of-bounds Write when considering the memory corruption aspect. Furthermore, because this exploit can be triggered remotely over a network connection without requiring user interaction or authentication, it aligns with ATT&CK technique T1190 Exploit Public-Facing Application, highlighting its potential for widespread automated exploitation against internet-facing services utilizing Nanomsg for messaging.
The operational impact of this vulnerability is severe due to the nature of message-oriented middleware like Nanomsg. These systems are often deployed in high-throughput environments where performance and reliability are paramount, leading developers to prioritize speed over rigorous input sanitization in certain code paths. If exploited successfully, an attacker gains full control over the underlying operating system through the compromised process. This can lead to data exfiltration, modification of critical application logic, or use of the compromised host as a pivot point for further attacks within the internal network infrastructure. In distributed systems relying on Nanomsg for inter-process communication, compromising one node could potentially allow lateral movement if session tokens or cryptographic keys are stored in memory accessible after exploitation.
Mitigation strategies must focus primarily on immediate software updates and secondary defensive measures. The most effective remediation is to upgrade the Nanomsg library to version 1.2.3 or later, where this buffer overflow has been patched by implementing proper length checks before copying header data into fixed-size buffers. Organizations unable to immediately patch their environments should consider deploying web application firewalls (WAFs) configured to inspect HTTP headers for anomalous lengths during WebSocket upgrade requests. Additionally, enabling ASLR and DEP/NX protections on the operating system can mitigate exploitation success rates by randomizing memory layouts and preventing code execution from data pages, although these are not substitutes for fixing the underlying source code defect. Regular vulnerability scanning of external-facing services using Nanomsg is also recommended to ensure timely detection of unpatched instances in production environments.