Denial of Service Vulnerability in NanoMQ MQTT Broker

CVE-2026-44639

What is CVE-2026-44639?

NanoMQ's MQTT broker is susceptible to a denial of service vulnerability due to an inefficiency in the processing of user properties in MQTT packets. Prior to version 0.24.14, the property_append() function, utilized in the MQTT v5 property decoder, incurred a quadratic time complexity (O(N²)) during linked-list traversals for each property added. A malicious remote client can exploit this flaw by sending PUBLISH or SUBSCRIBE packets with an excessive number of User Properties, leading to prolonged CPU usage and unresponsiveness of the broker. The issue has been addressed in version 0.24.14 to enhance the performance and resilience of the system.

References