Denial of Service Vulnerability in NanoMQ MQTT Broker by NanoMQ

CVE-2026-32696

What is CVE-2026-32696?

In NanoMQ version 0.24.6, a vulnerability exists when HTTP authentication is enabled. If a client connects to the broker without providing a username and password, and certain configuration parameters use placeholder values, a null pointer dereference occurs during the HTTP request processing. This leads to a segmentation fault (SIGSEGV), resulting in a crash of the broker and making it susceptible to denial of service attacks. This issue has been remediated in version 0.24.7.

References