CVE-2026-32134— NanoMQ: NULL Pointer Dereference Crash in tcptran_pipe_peer During Session Restore
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-32134
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
NanoMQ: NULL Pointer Dereference Crash in tcptran_pipe_peer During Session Restore
Source: NVD (National Vulnerability Database)
Vulnerability Description
NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In versions 0.24.10 and below, when NanoMQ handles high-concurrency reconnect traffic using a reconnect-collision payload, the broker can crash due to a NULL pointer dereference during MQTT session resumption for clean_start=0 clients. The transport's p_peer callback (tcptran_pipe_peer()) iterates cpipe->subinfol while copying session metadata from the cached old pipe to the new reconnecting pipe, without checking whether the pointer is NULL. Under a reconnect race, cpipe->subinfol can be freed and set to NULL before session restore invokes this function, resulting in a remote unauthenticated Denial-of-Service (process crash) condition. This issue has been fixed in version 0.24.11.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
空指针解引用
Source: NVD (National Vulnerability Database)
Vulnerability Title
NanoMQ 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
NanoMQ是美国EMQ开源的一款用于物联网边缘平台的轻量级快速 MQTT Broker。 NanoMQ 0.24.10及之前版本存在代码问题漏洞，该漏洞源于在clean_start=0客户端MQTT会话恢复期间，传输层的p_peer回调函数在复制会话元数据时未检查cpipe->subinfol指针是否为空，可能导致在重连竞争条件下该指针被释放并设置为空，从而引发空指针取消引用，导致远程未经身份验证的拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-32134
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-32134
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-32134 (1)
Vendor Advisories for CVE-2026-32134 (1)
Vendor Pages for CVE-2026-32134 (1)
- Release NanoMQ 0.24.11 · nanomq/nanomq · GitHubx_refsource_MISC
Other References for CVE-2026-32134 (1)
IV. Related Vulnerabilities
Same product: nanomq
- CVE-2026-32135
NanoMQ has Heap Buffer Overflow in URI Parameter Parsing - CVE-2026-34608
nanomq: Heap-Buffer-Overflow in webhook_inproc.c via cJSON_P - CVE-2026-32696
NanoMQ HTTP Auth: Missing username/password can trigger a NU - CVE-2026-25627
nanomq: OOB Read / Crash (DoS) via Malformed MQTT Remaining - CVE-2026-21888
MQTT v5 Variable Byte Integer parsing out-of-bounds: get_var
Same vendor: nanomq
- CVE-2026-32135
NanoMQ has Heap Buffer Overflow in URI Parameter Parsing - CVE-2026-34608
nanomq: Heap-Buffer-Overflow in webhook_inproc.c via cJSON_P - CVE-2026-32696
NanoMQ HTTP Auth: Missing username/password can trigger a NU - CVE-2026-25627
nanomq: OOB Read / Crash (DoS) via Malformed MQTT Remaining - CVE-2026-21888
MQTT v5 Variable Byte Integer parsing out-of-bounds: get_var
V. Comments for CVE-2026-32134
No comments yet