GHSA-qq2v-xvxg-3hvf: NULL Pointer Dereference in REST API properties_parse via Malformed user_properties

Q: Who can exploit this issue?

An attacker must be authenticated to NanoMQ's REST API and able to send a POST request to /api/v4/mqtt/publish. Exploitation does not require user interaction.

Q: Are default installations affected?

The issue affects NanoMQ versions 0.24.11 and earlier when the attacker can access the authenticated REST API publish endpoint. The provided information does not establish whether that endpoint is enabled or reachable by default.

Q: What should be done if patching cannot happen immediately?

Restrict access to the authenticated REST API publish endpoint to trusted users and networks, and limit credentials that can invoke it. This reduces the ability of an authenticated attacker to submit the malformed request.

Q: How can I identify exploitation attempts?

Look for POST requests to /api/v4/mqtt/publish in which user_properties is supplied as a JSON array rather than a JSON object, and investigate NanoMQ broker process crashes associated with those requests.

Q: What version fixes the issue?

The issue is patched in NanoMQ version 0.24.14.

Published Jul 20, 2026

Updated

In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in propertiesparse() allows an authenticated attacker to crash the NanoMQ broker by sending a POST request to /api/v4/mqtt/publish with userproperties as a JSON array instead of a JSON object. The crash occurs because strlen() is called on a NULL item->string pointer when iterating over array elements. An authenticated attacker can exploit this to crash the NanoMQ broker process. This is patched in version 0.24.14.

Affected Software

1 affected component

nanomq nanomq<=0.24.11

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade NanoMQ to a version that resolves this vulnerability.
Fixed in 0.24.14

Event History

Jul 20, 2026

CVE Published

via OSV·04:44 PM

Data Sourced

via OSV·04:44 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must be authenticated to NanoMQ's REST API and able to send a POST request to /api/v4/mqtt/publish. Exploitation does not require user interaction.

Are default installations affected?

The issue affects NanoMQ versions 0.24.11 and earlier when the attacker can access the authenticated REST API publish endpoint. The provided information does not establish whether that endpoint is enabled or reachable by default.

What should be done if patching cannot happen immediately?

Restrict access to the authenticated REST API publish endpoint to trusted users and networks, and limit credentials that can invoke it. This reduces the ability of an authenticated attacker to submit the malformed request.

How can I identify exploitation attempts?

Look for POST requests to /api/v4/mqtt/publish in which user_properties is supplied as a JSON array rather than a JSON object, and investigate NanoMQ broker process crashes associated with those requests.

What version fixes the issue?

The issue is patched in NanoMQ version 0.24.14.

GHSA-qq2v-xvxg-3hvf: NULL Pointer Dereference in REST API properties_parse via Malformed user_properties

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Are default installations affected?

What should be done if patching cannot happen immediately?

How can I identify exploitation attempts?

What version fixes the issue?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are default installations affected?

What should be done if patching cannot happen immediately?

How can I identify exploitation attempts?

What version fixes the issue?