Edge Messaging Platform Vulnerability in NanoMQ MQTT Broker

CVE-2025-68699

What is CVE-2025-68699?

The NanoMQ MQTT Broker has a vulnerability involving a protocol parsing inconsistency in version 0.24.6. This issue arises during the handling of shared subscriptions where malformed SUBSCRIBE topics are not validated correctly. Specifically, a missing element in the topic filter input can lead to the broker storing an invalid subscription. Subsequently, operations that match these subscriptions can trigger crashes due to invalid memory accesses, making the broker susceptible to remote attacks that exploit this flaw to cause service disruptions.

References