NULL Pointer Dereference in NanoMQ Broker Affects User Properties Handling
CVE-2026-47276

6.5MEDIUM

Key Information:

Vendor

NanoMQ

Status
NanoMQ
Vendor
CVE Published:
20 July 2026

What is CVE-2026-47276?

In certain versions of the NanoMQ broker, there is a vulnerability that allows an authenticated attacker to exploit a NULL pointer dereference within the properties_parse() function. This issue arises when user properties are sent as a JSON array instead of a JSON object during a POST request to the /api/v4/mqtt/publish endpoint. The failure occurs because the strlen() function attempts to evaluate a NULL pointer when processing elements of the passed array, leading to a crash of the NanoMQ broker process. This vulnerability highlights the importance of proper data handling and validation in APIs, and it has been addressed in subsequent releases beyond version 0.24.11.

Affected Version(s)

nanomq <= 0.24.11

References

https://github.com/nanomq/nanomq/security/advisories/GHSA...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.