CVE-2026-32134: NanoMQ: NULL Pointer Dereference Crash in tcptran_pipe_peer During Session Restore
NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In versions 0.24.10 and below, when NanoMQ handles high-concurrency reconnect traffic using a reconnect-collision payload, the broker can crash due to a NULL pointer dereference during MQTT session resumption for cleanstart=0 clients. The transport's ppeer callback (tcptranpipepeer()) iterates cpipe->subinfol while copying session metadata from the cached old pipe to the new reconnecting pipe, without checking whether the pointer is NULL. Under a reconnect race, cpipe->subinfol can be freed and set to NULL before session restore invokes this function, resulting in a remote unauthenticated Denial-of-Service (process crash) condition. This issue has been fixed in version 0.24.11.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NanoMQ MQTT Brokerto a version that resolves this vulnerability.Fixed in 0.24.11
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32134?
CVE-2026-32134 is classified as critical due to its potential to cause a denial of service via a NULL pointer dereference leading to a crash.
How do I fix CVE-2026-32134?
To fix CVE-2026-32134, upgrade NanoMQ to version 0.24.11 or later which contains the necessary patches.
What versions of NanoMQ are affected by CVE-2026-32134?
NanoMQ versions 0.24.10 and below are affected by CVE-2026-32134.
What is the impact of CVE-2026-32134 on NanoMQ?
CVE-2026-32134 can lead to a crash of the NanoMQ broker during session restore under high-concurrency reconnect scenarios.
Is there a known exploit for CVE-2026-32134?
Currently, there are no publicly available exploit details for CVE-2026-32134, but it poses a significant risk due to its nature.