MQTT Broker Vulnerability in NanoMQ Affects Subscriptions Handling

CVE-2026-73863

What is CVE-2026-73863?

A vulnerability exists in NanoMQ, an MQTT broker prior to version 0.24.14, affecting how the broker handles subscription identifiers. When a remote client sends a SUBSCRIBE packet with a multi-byte Properties Length and repeated subscription identifiers, it causes an erroneous reading beyond the designated heap buffer. This can lead to broker crashes, creating potential disruptions in service. The flaw arises during the parsing of subscription identifiers using the nmq_subinfo_decode() function, impacting the reliability of the MQTT messages processed by NanoMQ.

References