CVE-2026-61633: NanoMQ: Infinite Loop in UNSUBSCRIBE Decoder Leading to Remote DoS
NanoMQ is an MQTT broker. Prior to 0.24.14, the NanoMQ client function nnimqttmsgdecodeunsubscribe() in nng/src/supplemental/mqtt/mqttcodec.c does not handle a failed readuint16() while counting topics in a malformed UNSUBSCRIBE packet. A zero-length topic followed by trailing data can leave buf.curpos unchanged while topiccount continues to increase, allowing a malicious MQTT broker to hang a connecting MQTT 3.1.1 client, consume CPU and memory, and repeatedly deny service when automatic reconnection is enabled. The broker-side nmqunsubinfodecode path is not affected. This issue is fixed in version 0.24.14.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NanoMQto a version that resolves this vulnerability.Fixed in 0.24.14
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
NanoMQ MQTT 3.1.1 clients using versions before 0.24.14 are affected when connecting to a malicious broker. The NanoMQ broker-side nmq_unsubinfo_decode path is not affected.
What does an attacker need to exploit it?
An attacker needs to operate or control an MQTT broker that a vulnerable client connects to, then send a malformed UNSUBSCRIBE packet containing a zero-length topic followed by trailing data. Exploitation also requires user interaction in the form of the client connecting to that broker.
What is the practical impact if exploitation succeeds?
The affected client can enter an infinite loop, consuming CPU and memory and becoming unavailable. If automatic reconnection is enabled, the broker can repeatedly trigger the condition and sustain the denial of service.
What should be done if an upgrade cannot be applied immediately?
Avoid connecting affected clients to untrusted or malicious MQTT brokers. Disabling automatic reconnection can prevent repeated denial-of-service events, although it does not remove the underlying flaw.
How can I determine whether remediation is needed?
Check whether NanoMQ clients that use MQTT 3.1.1 are running a version earlier than 0.24.14 and connect to brokers that may be untrusted. Upgrade affected clients to version 0.24.14.