CVE-2026-22040: NanoMQ 0.24.6 Use-After-Free Leading to Heap Corruption and Broker Crash
NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In version 0.24.6, by generating a combined traffic pattern of high-frequency publishes and rapid reconnect/kick-out using the same ClientID and massive subscribe/unsubscribe jitter, it is possible to reliably trigger heap memory corruption in the Broker process, causing it to exit immediately with SIGABRT due to free(): invalid pointer. As of time of publication, no known patched versions are available.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22040?
CVE-2026-22040 has been rated as a high severity vulnerability due to its potential to lead to heap corruption and broker crashes.
How do I fix CVE-2026-22040?
To fix CVE-2026-22040, it is recommended to update to the latest version of NanoMQ that addresses this use-after-free issue.
What causes the use-after-free vulnerability in CVE-2026-22040?
CVE-2026-22040 is caused by a high-frequency combined traffic pattern of publishes and rapid reconnects using the same ClientID.
What are the potential impacts of exploiting CVE-2026-22040?
Exploiting CVE-2026-22040 can result in heap corruption, leading to crashes of the NanoMQ broker and potential denial of service.
Is CVE-2026-22040 present in versions prior to 0.24.6 of NanoMQ?
CVE-2026-22040 specifically affects NanoMQ version 0.24.6, and earlier versions do not include this vulnerability.