Read the docs
TI-2025-42170 Aliases CVE-2025-68699

NanoMQ $share/ Subscription Validation and Forwarding Parsing Inconsistency: NULL Pointer Increment Causes Crash

Priority LOW 29CWE-476Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-476.

Summary

NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In version 0.24.6, NanoMQ has a protocol parsing / forwarding inconsistency when handling shared subscriptions ($share/). A malformed SUBSCRIBE topic such as $share/ab (missing the second /) is not strictly validated during the subscription stage, so the invalid Topic Filter is stored into the subscription table. Later, when any PUBLISH matches this subscription, the broker send path (nmq_pipe_send_start_v4/v5) performs a second $share/ parsing using strchr() and increments the returned pointer without NULL checks. If the second strchr() returns NULL, sub_topic++ turns the pointer into an invalid address (e.g. 0x1). This invalid pointer is then passed into topic_filtern(), which triggers strlen() and crashes with SIGSEGV. The crash is stable and remotely triggerable. This issue has been patched in version 0.24.7.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00322 25th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nanomqnanomq= 0.24.6—No fix listedCNA
  • nanomq Vendornanomq Affected = 0.24.6 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:emqx:nanomq:0.24.6:*:*:*:*:*:*:*0.24.6Vulnerablenanomq
  • cpe:2.3:a:emqx:nanomq:0.24.6:*:*:*:*:*:*:* Versions 0.24.6 Vulnerable ·nanomq

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-68699

References

Exploit 1

Patch 1

  • TI-2026-24672 NanoMQ has Heap Buffer Overflow in URI Parameter Parsing CVSS 4.0HIGH 7.7
  • TI-2024-28570 An access control issue in NanoMQ v0.21.10 allows attackers to bypass security… CVSS 3.1HIGH 8.8
  • TI-2026-27853 An issue in EMQ NanoMQ v.0.24.9 allows a remote attacker to cause a denial of service via… CVSS 3.1HIGH 7.5
  • TI-2026-17589 MQTT v5 Variable Byte Integer parsing out-of-bounds: get_var_integer() CVSS 3.1HIGH 7.5
  • TI-2024-20452 Null Pointer Dereference vulnerability in topic_filtern function in mqtt_parser.c in… CVSS 3.1HIGH 7.5
  • TI-2023-17307 NanoMQ 0.16.5 is vulnerable to heap-use-after-free in the nano_ctx_send function of nmq_mqtt.c. CVSS 3.1HIGH 7.5
See all 32 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences