CVE-2026-32696: NanoMQ HTTP Auth: Missing username/password can trigger a NULL-pointer strlen() in auth_http.c:set_data(), causing a process crash — SIGSEGV, remotely triggerable
NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In NanoMQ version 0.24.6, after enabling auth.httpauth (HTTP authentication), when a client connects to the broker using MQTT CONNECT without providing username/password, and the configuration params uses the placeholders %u / %P (e.g., username="%u", password="%P"), the HTTP request construction phase enters authhttp.c:setdata(). This results in calling strlen() on a NULL pointer, causing a SIGSEGV crash. This crash can be triggered remotely, resulting in a denial of service. This issue has been patched in version 0.24.7.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32696?
CVE-2026-32696 is classified as a high-severity vulnerability due to the potential for a remote crash of the NanoMQ MQTT Broker.
How do I fix CVE-2026-32696?
To fix CVE-2026-32696, update NanoMQ to version 0.24.7 or later, where the vulnerability has been addressed.
What causes the vulnerability in CVE-2026-32696?
CVE-2026-32696 is caused by a NULL-pointer dereference in the function set_data() when username/password are missing in HTTP authentication.
Is CVE-2026-32696 remotely exploitable?
Yes, CVE-2026-32696 can be remotely triggered, allowing an attacker to crash the MQTT Broker.
What software versions are affected by CVE-2026-32696?
CVE-2026-32696 affects NanoMQ versions prior to 0.24.7, specifically version 0.24.6.