CyberRota Analysis
AI-GeneratedNanoMQ versions 0.24.11 and earlier are vulnerable to a NULL pointer dereference in the `properties_parse()` function, which can be exploited by an authenticated attacker to crash the broker by sending a malformed POST request to the `/api/v4/mqtt/publish` endpoint. The impact of this vulnerability is a denial of service, as it causes the NanoMQ broker process to terminate unexpectedly. Organizations using affected versions should prioritize upgrading to version 0.24.14 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in `properties_parse()` allows an authenticated attacker to crash the NanoMQ broker by sending a POST request to `/api/v4/mqtt/publish` with `user_properties` as a JSON array instead of a JSON object. The crash occurs because `strlen()` is called on a NULL `item->string` pointer when iterating over array elements. An authenticated attacker can exploit this to crash the NanoMQ broker process. This is patched in version 0.24.14.