NanoMQ up to 0.24.13 MQTT v5 Property Decoder mqtt_codec.c property_append denial of service

Summaryinfo

A vulnerability, which was classified as problematic, was found in NanoMQ up to 0.24.13. Affected is the function property_append of the file nng/src/supplemental/mqtt/mqtt_codec.c of the component MQTT v5 Property Decoder. Executing a manipulation can lead to denial of service. This vulnerability is handled as CVE-2026-44639. The attack can be executed remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in NanoMQ up to 0.24.13. It has been declared as problematic. This vulnerability affects the function property_append of the file nng/src/supplemental/mqtt/mqtt_codec.c of the component MQTT v5 Property Decoder. The manipulation with an unknown input leads to a denial of service vulnerability. The CWE definition for the vulnerability is CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. As an impact it is known to affect availability. CVE summarizes:

NanoMQ is an MQTT broker. Prior to 0.24.14, NanoMQ's MQTT v5 property decoder in nng/src/supplemental/mqtt/mqtt_codec.c uses property_append() to walk the entire linked list for each property added by decode_buf_properties(). A remote unauthenticated client can supply a PUBLISH or SUBSCRIBE packet containing many User Properties, causing O(N²) linked-list insertion and CPU work that makes the broker unresponsive; repeated packets can sustain the denial of service. This issue is fixed in version 0.24.14.

The advisory is available at github.com. This vulnerability was named CVE-2026-44639 since 05/07/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1499 by the MITRE ATT&CK project.

Upgrading to version 0.24.14 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• NanoMQ

Version

• 0.24.0
• 0.24.1
• 0.24.2
• 0.24.3
• 0.24.4
• 0.24.5
• 0.24.6
• 0.24.7
• 0.24.8
• 0.24.9
• 0.24.10
• 0.24.11
• 0.24.12
• 0.24.13

Website

• Product: https://github.com/nanomq/nanomq/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion