CVE-2026-44639: NanoMQ: O(N²) Denial of Service in MQTT v5 Property Parsing
NanoMQ is an MQTT broker. Prior to 0.24.14, NanoMQ's MQTT v5 property decoder in nng/src/supplemental/mqtt/mqttcodec.c uses propertyappend() to walk the entire linked list for each property added by decodebufproperties(). A remote unauthenticated client can supply a PUBLISH or SUBSCRIBE packet containing many User Properties, causing O(N²) linked-list insertion and CPU work that makes the broker unresponsive; repeated packets can sustain the denial of service. This issue is fixed in version 0.24.14.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NanoMQto a version that resolves this vulnerability.Fixed in 0.24.14
Event History
Frequently Asked Questions
Which deployments are exposed to this denial of service?
NanoMQ versions prior to 0.24.14 are affected. Exposure requires the broker to accept MQTT v5 PUBLISH or SUBSCRIBE packets from a remote client.
Does exploitation require authentication or user interaction?
No. A remote unauthenticated client can trigger the issue, and no user interaction is required, but the attacker must craft packets with many MQTT v5 User Properties.
What is the immediate mitigation if upgrading is not possible?
The provided information identifies upgrading to NanoMQ 0.24.14 as the fix. It does not provide a configuration-based workaround; reducing access by untrusted clients to the broker would limit who can send the malicious packets.
How could an attack affect broker availability?
Packets with many User Properties cause quadratic linked-list insertion and CPU processing. Repeated malicious PUBLISH or SUBSCRIBE packets can keep the broker unresponsive.