CVE-2026-47276 | In nanomq versions 0.24.11 and earlier, a NULL pointer deref… | CVSS 6.5 MEDIUM

Description

In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in `properties_parse()` allows an authenticated attacker to crash the NanoMQ broker by sending a POST request to `/api/v4/mqtt/publish` with `user_properties` as a JSON array instead of a JSON object. The crash occurs because `strlen()` is called on a NULL `item->string` pointer when iterating over array elements. An authenticated attacker can exploit this to crash the NanoMQ broker process. This is patched in version 0.24.14.

Metadata

CVE ID: CVE-2026-47276
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-05-18 23:03 UTC
Published: 2026-07-20 16:44 UTC
Last updated: 2026-07-20 17:41 UTC
Primary CWE: CWE-476
CWE-476: NULL Pointer Dereference
Vendor / Product: nanomq / nanomq
Sources: cve.org · NVD

Severity & Metrics

6.5 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
nanomq	nanomq	—	<= 0.24.11

Weakness (CWE)

CWE	Source	Description
CWE-476	cna	CWE-476: NULL Pointer Dereference

CVSS scores (1)

Score	Severity	Version	Source	Vector
6.5	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References (1)

https://github.com/nanomq/nanomq/security/advisories/GHSA-qq2v-xvxg-3hvf https://github.com/nanomq/nanomq/security/advisories/GHSA-qq2v-xvxg-3hvf