Type Confusion in NanoMQ MQTT Broker by NanoMQ
CVE-2026-44640

4.5MEDIUM

Key Information:

Vendor

NanoMQ

Status
NanoMQ
Vendor
CVE Published:
29 May 2026

What is CVE-2026-44640?

The NanoMQ MQTT Broker, which serves as an Edge Messaging Platform, contains a type confusion vulnerability in versions prior to 0.24.14. This issue arises from the incorrect handling of the provisioning data pointer during the dialer close process. Specifically, the aio->prov_data is stored as nni_quic_conn* but interpreted as ex_quic_conn*, leading to potential invalid object interpretation. This flaw may result in undesirable behavior such as hang or crash conditions during close operations. Users are strongly advised to update to version 0.24.14 or later to mitigate this risk.

Affected Version(s)

nanomq < 0.24.14

References

https://github.com/nanomq/nanomq/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/nanomq/nanomq/releases/tag/0.24.14
x_refsource_MISC

CVSS V3.1

Score:
4.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.