CyberRota Analysis
AI-GeneratedThe NanoMQ MQTT broker prior to version 0.24.14 contains a vulnerability in the client function that improperly handles malformed UNSUBSCRIBE packets, potentially allowing a malicious broker to exhaust CPU and memory resources of connecting MQTT 3.1.1 clients. This can lead to denial-of-service conditions, especially if automatic reconnection is enabled. Users of affected versions should prioritize upgrading to version 0.24.14 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
NanoMQ is an MQTT broker. Prior to 0.24.14, the NanoMQ client function nni_mqtt_msg_decode_unsubscribe() in nng/src/supplemental/mqtt/mqtt_codec.c does not handle a failed read_uint16() while counting topics in a malformed UNSUBSCRIBE packet. A zero-length topic followed by trailing data can leave buf.curpos unchanged while topic_count continues to increase, allowing a malicious MQTT broker to hang a connecting MQTT 3.1.1 client, consume CPU and memory, and repeatedly deny service when automatic reconnection is enabled. The broker-side nmq_unsubinfo_decode path is not affected. This issue is fixed in version 0.24.14.