NanoMQ MQTT Broker up to 0.24.9 Nng Message webhook_inproc.c hook_work_cb out-of-bounds

Summaryinfo

A vulnerability, which was classified as problematic, has been found in NanoMQ MQTT Broker up to 0.24.9. This issue affects the function hook_work_cb of the file webhook_inproc.c of the component Nng Message Handler. This manipulation causes out-of-bounds. This vulnerability is registered as CVE-2026-34608. Remote exploitation of the attack is possible. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in NanoMQ MQTT Broker up to 0.24.9. It has been declared as problematic. Affected by this vulnerability is the function hook_work_cb of the file webhook_inproc.c of the component Nng Message Handler. The manipulation with an unknown input leads to a out-of-bounds vulnerability. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect availability. The summary by CVE is:

NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to version 0.24.10, in NanoMQ's webhook_inproc.c, the hook_work_cb() function processes nng messages by parsing the message body with cJSON_Parse(body). The body is obtained from nng_msg_body(msg), which is a binary buffer without a guaranteed null terminator. This leads to an out-of-bounds read (OOB read) as cJSON_Parse reads until it finds a \0, potentially accessing memory beyond the allocated buffer (e.g., nng_msg metadata or adjacent heap/stack). The issue is often masked by nng's allocation padding (extra 32 bytes of zeros for non-power-of-two sizes =1024 (no padding added). This issue has been patched in version 0.24.10.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-34608 since 03/30/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation requires an enhanced level of successful authentication. Technical details are known, but no exploit is available.

Upgrading to version 0.24.10 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 9499a4b2c47998a6aadb69238c18b9e6771b1691 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• NanoMQ

Name

• MQTT Broker

Version

• 0.24.0
• 0.24.1
• 0.24.2
• 0.24.3
• 0.24.4
• 0.24.5
• 0.24.6
• 0.24.7
• 0.24.8
• 0.24.9

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion