GHSA-6mwg-445v-2qrv: NanoMQ: O(N²) Denial of Service in MQTT v5 Property Parsing

Q: Which deployments are exposed to this denial of service?

NanoMQ deployments running a version earlier than 0.24.14 are affected if a remote client can send MQTT v5 PUBLISH or SUBSCRIBE packets to the broker. The issue can be triggered without authentication.

Q: What does an attacker need to send to trigger the issue?

An attacker must craft an MQTT v5 PUBLISH or SUBSCRIBE packet containing many User Properties. Processing those properties causes quadratic linked-list insertion work, and repeated packets can keep the broker unresponsive.

Q: How can I tell whether my broker is affected?

Check the deployed NanoMQ version. Versions earlier than 0.24.14 are affected; version 0.24.14 contains the fix.

Q: What should be done if upgrading cannot happen immediately?

The provided information does not identify a configuration workaround. Reduce exposure to untrusted remote clients where possible, because the attack requires network access but no authentication.

Published Sep 18, 2026

Updated

NanoMQ is an MQTT broker. Prior to 0.24.14, NanoMQ's MQTT v5 property decoder in nng/src/supplemental/mqtt/mqttcodec.c uses propertyappend() to walk the entire linked list for each property added by decodebufproperties(). A remote unauthenticated client can supply a PUBLISH or SUBSCRIBE packet containing many User Properties, causing O(N²) linked-list insertion and CPU work that makes the broker unresponsive; repeated packets can sustain the denial of service. This issue is fixed in version 0.24.14.

Affected Software

1 affected component

nanomq nanomq<0.24.14

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade NanoMQ to a version that resolves this vulnerability.
Fixed in 0.24.14

Event History

Sep 18, 2026

CVE Published

via OSV·04:17 PM

Data Sourced

via OSV·04:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this denial of service?

NanoMQ deployments running a version earlier than 0.24.14 are affected if a remote client can send MQTT v5 PUBLISH or SUBSCRIBE packets to the broker. The issue can be triggered without authentication.

What does an attacker need to send to trigger the issue?

An attacker must craft an MQTT v5 PUBLISH or SUBSCRIBE packet containing many User Properties. Processing those properties causes quadratic linked-list insertion work, and repeated packets can keep the broker unresponsive.

How can I tell whether my broker is affected?

Check the deployed NanoMQ version. Versions earlier than 0.24.14 are affected; version 0.24.14 contains the fix.

What should be done if upgrading cannot happen immediately?

The provided information does not identify a configuration workaround. Reduce exposure to untrusted remote clients where possible, because the attack requires network access but no authentication.

GHSA-6mwg-445v-2qrv: NanoMQ: O(N²) Denial of Service in MQTT v5 Property Parsing

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this denial of service?

What does an attacker need to send to trigger the issue?

How can I tell whether my broker is affected?

What should be done if upgrading cannot happen immediately?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this denial of service?

What does an attacker need to send to trigger the issue?

How can I tell whether my broker is affected?

What should be done if upgrading cannot happen immediately?