CVE-2026-32135CWE-122

NanoMQ has Heap Buffer Overflow in URI Parameter Parsing

High · published April 20, 2026

CVSS v4.0
7.7
EPSS
1%
Percentile
60.4
In the wild
Unconfirmed
What it is

NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Versions prior to 0.24.11 have a remotely triggerable heap buffer overflow in the `uri_param_parse` function of NanoMQ's REST API. The vulnerability occurs due to an off-by-one error when allocating memory for query parameter keys and values, allowing an attacker to write a null byte beyond the allocated buffer. This can be triggered via a crafted HTTP request. Version 0.24.11 patches the issue.

The record
Technical detail
CVSS v4.0
7.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
EPSS
0.00936 · 60.4th percentile
Weakness
CWE-122 · Heap-based Buffer Overflow
Published
2026-04-20T19:23Z
EPSS history
Timeline
  • 20 APR 19:23Z
    NanoMQ has Heap Buffer Overflow in URI Parameter Parsing
    cvelistv5