CVE-2026-32135: NanoMQ has Heap Buffer Overflow in URI Parameter Parsing
NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Versions prior to 0.24.11 have a remotely triggerable heap buffer overflow in the uriparamparse function of NanoMQ's REST API. The vulnerability occurs due to an off-by-one error when allocating memory for query parameter keys and values, allowing an attacker to write a null byte beyond the allocated buffer. This can be triggered via a crafted HTTP request. Version 0.24.11 patches the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32135?
CVE-2026-32135 has a high severity rating due to the potential for remote exploitation via heap buffer overflow.
How do I fix CVE-2026-32135?
To fix CVE-2026-32135, upgrade to NanoMQ version 0.24.11 or later.
What software is affected by CVE-2026-32135?
CVE-2026-32135 affects all versions of NanoMQ prior to 0.24.11.
What type of vulnerability is CVE-2026-32135?
CVE-2026-32135 is classified as a heap buffer overflow vulnerability.
Can CVE-2026-32135 be exploited remotely?
Yes, CVE-2026-32135 can be remotely exploited through the vulnerable REST API.