CVE-2026-47276: NULL Pointer Dereference in REST API properties_parse via Malformed user_properties
In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in propertiesparse() allows an authenticated attacker to crash the NanoMQ broker by sending a POST request to /api/v4/mqtt/publish with userproperties as a JSON array instead of a JSON object. The crash occurs because strlen() is called on a NULL item->string pointer when iterating over array elements. An authenticated attacker can exploit this to crash the NanoMQ broker process. This is patched in version 0.24.14.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nanomqto a version that resolves this vulnerability.Fixed in 0.24.14
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47276?
The severity of CVE-2026-47276 is rated as medium with a score of 6.5.
How do I fix CVE-2026-47276?
To fix CVE-2026-47276, upgrade NanoMQ to version 0.24.12 or later, where the vulnerability is patched.
What kind of attack does CVE-2026-47276 allow?
CVE-2026-47276 allows an authenticated attacker to crash the NanoMQ broker by exploiting a NULL pointer dereference.
Which versions of NanoMQ are affected by CVE-2026-47276?
NanoMQ versions 0.24.11 and earlier are affected by CVE-2026-47276.
What component of the NanoMQ is impacted by CVE-2026-47276?
CVE-2026-47276 impacts the properties_parse function in the REST API of NanoMQ.