CVE-2026-25627: nanomq: OOB Read / Crash (DoS) via Malformed MQTT Remaining Length over WebSocket
NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to version 0.24.8, NanoMQ’s MQTT-over-WebSocket transport can be crashed by sending an MQTT packet with a deliberately large Remaining Length in the fixed header while providing a much shorter actual payload. The code path copies Remaining Length bytes without verifying that the current receive buffer contains that many bytes, resulting in an out-of-bounds read (ASAN reports OOB / crash). This is remotely triggerable over the WebSocket listener. This issue has been patched in version 0.24.8.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25627?
The severity of CVE-2026-25627 is classified as a Denial of Service (DoS) vulnerability.
How do I fix CVE-2026-25627?
To mitigate CVE-2026-25627, update NanoMQ to version 0.24.8 or later.
What causes the CVE-2026-25627 vulnerability?
CVE-2026-25627 is caused by an out-of-bounds read condition due to a malformed MQTT remaining length in packets sent over WebSockets.
Which versions of NanoMQ are affected by CVE-2026-25627?
Versions of NanoMQ prior to 0.24.8 are affected by CVE-2026-25627.
What are the potential impacts of CVE-2026-25627?
The potential impacts of CVE-2026-25627 include crashing the NanoMQ broker and resulting service downtime.