Denial of Service Vulnerability in NanoMQ MQTT Broker

CVE-2026-61633

What is CVE-2026-61633?

The NanoMQ MQTT broker prior to version 0.24.14 contains a vulnerability in its nni_mqtt_msg_decode_unsubscribe() function. This issue arises when the broker fails to handle malformed UNSUBSCRIBE packets properly. Specifically, a zero-length topic followed by extraneous data can cause the topic count to increase incorrectly without changing the buffer's current position. This flaw allows a malicious broker to target an MQTT 3.1.1 client, leading to resource exhaustion by consuming excessive CPU and memory, ultimately resulting in a denial of service, especially if automatic reconnection attempts are enabled. The vulnerability has been addressed in version 0.24.14.

References