CVE-2025-59947: NanoMQ has Buffer Overflow
NanoMQ is a messaging broker/bus for IoT Edge & SDV. Versions prior to 0.24.4 have a buffer overflow case while the PUBLISH packets trigger both shared subscription and vanila subscription. This is fixed in version 0.24.4. As a workaround, disable shared subscription.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NanoMQto a version that resolves this vulnerability.Fixed in 0.24.4 - Configuration
Disable shared subscription as a workaround.
NanoMQ shared subscription = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59947?
CVE-2025-59947 is classified as a high-severity vulnerability due to the buffer overflow that can be triggered by PUBLISH packets.
How do I fix CVE-2025-59947?
To fix CVE-2025-59947, update to NanoMQ version 0.24.4 or later.
What versions of NanoMQ are affected by CVE-2025-59947?
CVE-2025-59947 affects all versions of NanoMQ prior to 0.24.4.
Is there a workaround for CVE-2025-59947?
Yes, a workaround for CVE-2025-59947 is to disable shared subscriptions in the affected versions.
What type of issue is CVE-2025-59947?
CVE-2025-59947 is a buffer overflow vulnerability affecting how PUBLISH packets are handled in NanoMQ.