NanoMQ is a messaging broker/bus for IoT Edge & SDV. Versions prior to 0.24.4 have a buffer overflow case while the PUBLISH packets trigger both shared subscription and vanila subscription. This is fixed in version 0.24.4. As a workaround, disable shared subscription.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://github.com/nanomq/nanomq/commit/5f5581054bb92f102cf99251e8af2f43763d457b Patch
- https://github.com/nanomq/nanomq/issues/2110 Issue Tracking, Patch
- https://github.com/nanomq/nanomq/security/advisories/GHSA-98f4-cmg8-x7f3 Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 8.5 · emqxNVD modified 2026-10-14 13:10
Affected (CPE criteria) 1
cpe:2.3:a:emqx:nanomq:*:*:*:*:*:*:*:*