Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-44639— NanoMQ: O(N²) Denial of Service in MQTT v5 Property Parsing

Quick assessment

Affected
nanomq nanomq
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

NanoMQ 是一款 MQTT 消息代理（broker）。在 0.24.14 版本之前，NanoMQ 位于 中的 MQTT v5 属性解码器使用 函数为每个通过 添加的属性遍历整个链表。远程未认证客户端可以通过构造包含大量用户属性（User Properties）的 PUBLISH 或 SUBSCRIBE 数据包，导致 O(N²) 复杂度的链表插入和 CPU 开销，从而致使消息代理无法响应；重复发送此类数据包可维持拒绝服务（DoS）状态。该问题已在 0.24.14 版本中修复。

CVSS 3.7 · Low EPSS 0.44% · P39

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 1

VendorProduct Version RangeStatus
nanomq nanomq < 0.24.14 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-44639

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
NanoMQ: O(N²) Denial of Service in MQTT v5 Property Parsing
Source: CVE Program / CVE List V5
Vulnerability Description
NanoMQ is an MQTT broker. Prior to 0.24.14, NanoMQ's MQTT v5 property decoder in nng/src/supplemental/mqtt/mqtt_codec.c uses property_append() to walk the entire linked list for each property added by decode_buf_properties(). A remote unauthenticated client can supply a PUBLISH or SUBSCRIBE packet containing many User Properties, causing O(N²) linked-list insertion and CPU work that makes the broker unresponsive; repeated packets can sustain the denial of service. This issue is fixed in version 0.24.14.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
算法复杂性
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
nanomq nanomq < 0.24.14 -

II. Public POCs for CVE-2026-44639

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-44639

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-44639 (1)

Vendor Pages for CVE-2026-44639 (1)

Other References for CVE-2026-44639 (1)

Same Patch Batch · nanomq · 2026-09-18 · 3 CVEs total

CVE-2026-73863 7.0 HIGH NanoMQ: Heap-Buffer-Overflow in `nmq_subinfo_decode()` During MQTT v5 SUBSCRIBE Parsing
CVE-2026-61633 2.0 LOW NanoMQ: Infinite Loop in UNSUBSCRIBE Decoder Leading to Remote DoS

IV. Related Vulnerabilities

Same product: nanomq
Same vendor: nanomq
Same weakness: CWE-407