GHSA-9fgw-v323-jmjj: NanoMQ: QUIC Dialer Close Type Confusion

Q: Which NanoMQ versions are affected?

Versions prior to 0.24.14 are affected. The issue is fixed in NanoMQ 0.24.14.

Q: What conditions are required to trigger the issue?

The issue occurs on the QUIC dialer close path, where connection provider data stored during dialing is interpreted as a different connection object type. The supplied CVSS vector indicates local access, high attack complexity, no privileges required, and user interaction required.

Q: What is the impact if the vulnerable close path is reached?

Invalid object interpretation can cause the close path to hang or crash. The CVSS vector also indicates low impacts to confidentiality, integrity, and availability.

Q: How can I mitigate this issue?

Upgrade NanoMQ to version 0.24.14 or later, which contains the fix. No alternative mitigation is provided in the available data.

Published May 29, 2026

Updated

NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to 0.24.14, aio->provdata is stored as nniquicconn during dialing, but read as exquicconn during dialer close. This type confusion causes invalid object interpretation and leads to close-path hang/crash behavior. This vulnerability is fixed in 0.24.14.

Affected Software

1 affected component

NanoMQ NanoMQ MQTT broker<0.24.14

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade NanoMQ to a version that resolves this vulnerability.
Fixed in 0.24.14

Event History

May 29, 2026

CVE Published

via OSV·07:28 PM

Data Sourced

via OSV·07:28 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which NanoMQ versions are affected?

Versions prior to 0.24.14 are affected. The issue is fixed in NanoMQ 0.24.14.

What conditions are required to trigger the issue?

The issue occurs on the QUIC dialer close path, where connection provider data stored during dialing is interpreted as a different connection object type. The supplied CVSS vector indicates local access, high attack complexity, no privileges required, and user interaction required.

What is the impact if the vulnerable close path is reached?

Invalid object interpretation can cause the close path to hang or crash. The CVSS vector also indicates low impacts to confidentiality, integrity, and availability.

How can I mitigate this issue?

Upgrade NanoMQ to version 0.24.14 or later, which contains the fix. No alternative mitigation is provided in the available data.

GHSA-9fgw-v323-jmjj: NanoMQ: QUIC Dialer Close Type Confusion

Affected Software

Remediation

Event History

Frequently Asked Questions

Which NanoMQ versions are affected?

What conditions are required to trigger the issue?

What is the impact if the vulnerable close path is reached?

How can I mitigate this issue?

Company

Resources

Contact

Frequently Asked Questions

Which NanoMQ versions are affected?

What conditions are required to trigger the issue?

What is the impact if the vulnerable close path is reached?

How can I mitigate this issue?