Out-of-Bounds Read in NanoMQ MQTT Broker

CVE-2026-34608

What is CVE-2026-34608?

The NanoMQ MQTT Broker prior to version 0.24.10 contains a vulnerability in the hook_work_cb() function within webhook_inproc.c. This function processes messages from the nng library and uses cJSON_Parse to parse the message body. The message body, retrieved from nng_msg_body(msg), is a binary buffer that may not have a null terminator, resulting in an out-of-bounds read as cJSON_Parse continues reading until it finds a null character. This poses a risk of accessing memory outside of the allocated buffer, potentially exposing heap or stack data. The issue becomes particularly apparent when the length of the JSON payload is a power-of-two and greater than or equal to 1024, which does not benefit from the padding provided by nng’s allocation mechanism. A fix has been implemented in version 0.24.10.

References