NanoMQ MQTT Broker up to 0.24.10 REST API uri_param_parse heap-based overflow

Summaryinfo

A vulnerability described as critical has been identified in NanoMQ MQTT Broker up to 0.24.10. This impacts the function uri_param_parse of the component REST API. The manipulation results in heap-based overflow. This vulnerability is identified as CVE-2026-32135. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as critical, was found in NanoMQ MQTT Broker up to 0.24.10. Affected is the function uri_param_parse of the component REST API. The manipulation with an unknown input leads to a heap-based overflow vulnerability. CWE is classifying the issue as CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). This is going to have an impact on availability. CVE summarizes:

NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Versions prior to 0.24.11 have a remotely triggerable heap buffer overflow in the `uri_param_parse` function of NanoMQ's REST API. The vulnerability occurs due to an off-by-one error when allocating memory for query parameter keys and values, allowing an attacker to write a null byte beyond the allocated buffer. This can be triggered via a crafted HTTP request. Version 0.24.11 patches the issue.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-32135 since 03/10/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available.

It is declared as proof-of-concept.

Upgrading to version 0.24.11 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-23939). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• NanoMQ

Name

• MQTT Broker

Version

• 0.24.0
• 0.24.1
• 0.24.2
• 0.24.3
• 0.24.4
• 0.24.5
• 0.24.6
• 0.24.7
• 0.24.8
• 0.24.9
• 0.24.10

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion