Protocol-Semantics Flaw in NanoMQ MQTT v5 Handling

CVE-2026-35217

What is CVE-2026-35217?

NanoMQ contains a protocol-semantics flaw in its MQTT v5 SUBSCRIBE handling that allows a broker to accept malformed subscription packets. If the final 1-byte Subscription Options field is missing, the packet can still be registered in the broker's internal state. This flaw can lead to a 1-byte out-of-bounds read, triggering a heap-buffer-overflow according to ASAN. In certain conditions, a malformed SUBSCRIBE packet that should normally be rejected is treated as a successful subscription, creating vulnerabilities in memory management and potential security risks.

References