CVE-2026-36590CWE-400CWE-772denial-of-service

CVE-2026-36590

High · published July 16, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
47.4
In the wild
Unconfirmed
What it is

An issue in EMQ NanoMQ v.0.24.9 allows a remote attacker to cause a denial of service via the nni_qos_db_set function in broker_tcp.c component

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00588 · 47.4th percentile
Weaknesses
CWE-400 · Uncontrolled Resource Consumption; CWE-772 · Missing Release of Resource after Effective Lifetime
Published
2026-07-16T02:16Z
Affected products (1)
ProductVersionsFixed in
emqx/nanomqall versions—
References (3)
https://github.com/MoXie25/NanoMQ-Memory-Leak-Research.git · [email protected]https://github.com/MoXie25/NanoMQ-Memory-Leak-Research/blob/main/README.md · [email protected]https://github.com/MoXie25/NanoMQ-Memory-Leak-Research/blob/main/README.md · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 15 JUL 00:00Z
    An issue in EMQ NanoMQ v.0.24.9 allows a remote attacker to cause a denial of service via the nni_qos_db_set function in broker_tcp.c component
    cvelistv5