CVE-2025-59946: NanoMQ has a Use After Free vulnerability via sub info list
NanoMQ MQTT Broker (NanoMQ) is an Edge Messaging Platform. Prior to version 0.24.2, there is a classical data racing issue about sub info list which could result in heap use after free crash. This issue has been patched in version 0.24.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NanoMQ MQTT Brokerto a version that resolves this vulnerability.Fixed in 0.24.2
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59946?
CVE-2025-59946 has been classified as a critical vulnerability due to the potential for heap use after free crashes.
How do I fix CVE-2025-59946?
To fix CVE-2025-59946, upgrade NanoMQ to version 0.24.2 or later where the issue has been patched.
What impact does CVE-2025-59946 have on NanoMQ?
CVE-2025-59946 can lead to unstable behavior and crashes within the NanoMQ broker due to a data racing issue.
Is CVE-2025-59946 present in all versions of NanoMQ?
CVE-2025-59946 affects all versions of NanoMQ prior to 0.24.2.
How can I identify if my system is vulnerable to CVE-2025-59946?
If you are running a version of NanoMQ less than 0.24.2, your system is vulnerable to CVE-2025-59946.