NanoMQ CVE-2025-32135 Heap Buffer Overflow in URI Parameter Parsing

Vulnerability Summary: Heap Buffer Overflow in NanoMQ URI Parameter Parsing Overview A remotely triggered heap buffer overflow vulnerability exists in the function within NanoMQ's REST API. The issue occurs when allocating memory to store query parameter keys and values, allowing an attacker to write a null terminator beyond the allocated buffer. This vulnerability can be triggered via a crafted HTTP request. Impact Scope Package: Affected Version: Severity: Moderate CVE ID: CVE-2025-32135 Remediation Currently no patched version is available (None). Vulnerability Details Root Cause In , the function processes URI query parameters. It iterates over the parameter string and allocates memory for key and value buffers using . However, it fails to account for the null terminator when writing to these buffers. Code Example When is , returns 3. allocates 3 bytes. writes (4 bytes), causing a 1-byte overflow. Proof of Concept (PoC) Steps 1. Compile nanomq with ASAN. 2. Run nanomq. 3. Monitor logs. 4. Execute the following curl command and observe ASAN output: Sample Log ```text Abort finding default config path path /root/targets/nanomq/clean_nanomq/build/nanomq/nanomq Set new conf path from env: (null) 2025-01-25 12:06:15 [200560] INFO: [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanomq] [0x7f0000000000] [root/targets/nanomq/clean_nanomq/nanomq/apps/broker.c:1206] [0x7f0000000000] [nanom

Goal Reached Thanks to every supporter — we hit 100%!

NanoMQ CVE-2025-32135 Heap Buffer Overflow in URI Parameter Parsing

More from this source