What’s Vulnerable › Vulnerabilities

CVE-2026-32135: NanoMQ has Heap Buffer Overflow in URI Parameter Parsing

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-04-20 · updated 2026-06-17
• Weakness: CWE-122

Description

NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Versions prior to 0.24.11 have a remotely triggerable heap buffer overflow in the `uri_param_parse` function of NanoMQ's REST API. The vulnerability occurs due to an off-by-one error when allocating memory for query parameter keys and values, allowing an attacker to write a null byte beyond the allocated buffer. This can be triggered via a crafted HTTP request. Version 0.24.11 patches the issue.

Affected products

• nanomq: before 0.24.11 — fixed in 0.24.11

How to fix

Upgrade to a fixed version: nanomq 0.24.11. Check the vendor advisory for mitigations.

References

• https://github.com/nanomq/nanomq/commit/69a97b3b39cc218f044f1c8896f4d3d8757bb394
• https://github.com/nanomq/nanomq/issues/2247
• https://github.com/nanomq/nanomq/security/advisories/GHSA-6w96-9qw7-m599

Get alerted when CVE-2026-32135 or the next vulnerability affects your stack