Remote Denial of Service in NanoMQ Due to Malicious MQTT Broker

CVE-2026-47275

What is CVE-2026-47275?

In affected versions of NanoMQ, a vulnerability allows a malicious MQTT broker to exploit a flaw in the message decoding process. When a CONNECT packet is sent without connect-level properties but with will properties, the system attempts to dereference a null pointer. This leads to a crash of the MQTT client, resulting in a remote denial-of-service condition. The issue also affects the bridge mode, allowing attackers to crash the client with minimal effort, potentially causing persistent outages due to repeated crashes during auto-reconnect attempts.

References