NanoMQ 0.24.14 Patch: Fixes Pre-Auth Memory Corruption and MQTTv5 Parser Double Free/UAF Vulnerabilities

Vulnerability Overview NanoMQ version 0.24.14 resolves several critical vulnerabilities, including memory safety issues and boundary check errors. These vulnerabilities could lead to program crashes, data leakage, or denial-of-service (DoS) attacks. Impact Scope Pre-Auth Memory Safety: Memory corruption/integer underflow vulnerability in the HTTP API. MQTTv5 Parser Hardening: - Double Free vulnerability in . - NULL pointer dereference (SEGV) vulnerability in . - Multiple Heap Use-After-Free (UAF) vulnerabilities. HTTP API: Out-of-bounds vulnerability in the API. Remediation Pre-Auth Memory Safety: Fixed the memory corruption/integer underflow vulnerability in the HTTP API. MQTTv5 Parser Hardening: - Fixed the Double Free vulnerability in . - Fixed the NULL pointer dereference (SEGV) vulnerability in . - Fixed multiple Heap Use-After-Free (UAF) vulnerabilities. HTTP API: Fixed the out-of-bounds vulnerability in the API. Other Improvements Offline Message Cache: Introduced a new offline message caching mechanism to improve data reliability for disconnected clients. NNG Pub/Sub Bridging: Added NNG Pub/Sub bridging functionality to support bridging between NanoMQ and NanoNNG. REST API Upgrades: The endpoint now supports multi-condition queries, providing finer-grained control over client monitoring. CLI Enhancements: now fully supports MQTT v5 client options. Contributors JaylinYu wanghaEMQ alvin1221 Full Changelog NanoMQ Changelog NanoNNG Changelog Notes This release also includes other security hardening and optimization measures, such as deploying new boundary checkers and security guards, cleaning up redundant logs, and adding new internal flags, among others.

Goal Reached Thanks to every supporter — we hit 100%!

NanoMQ 0.24.14 Patch: Fixes Pre-Auth Memory Corruption and MQTTv5 Parser Double Free/UAF Vulnerabilities

More from this source