CVE-2024-42650: Emqx Nanomq DOS Vulnerability

CVE-2024-42650 Overview

CVE-2024-42650 affects NanoMQ 0.17.5, an open-source MQTT broker maintained by EMQX. The vulnerability resides in the /nanomq/pub_handler.c component and triggers a segmentation fault when the broker processes a crafted PUBLISH message. Remote attackers can exploit this flaw without authentication or user interaction to crash the broker process, resulting in a Denial of Service (DoS) condition.

NanoMQ is widely deployed in Internet of Things (IoT) and edge computing scenarios, where broker availability is critical for message-driven workloads. A single malformed packet sent over the network is sufficient to terminate the service.

Critical Impact
A remote, unauthenticated attacker can crash the NanoMQ broker by sending a single crafted MQTT PUBLISH message, disrupting all dependent IoT and edge messaging operations.

Affected Products

EMQX NanoMQ 0.17.5
Deployments using pub_handler.c from the affected release
IoT and edge gateways embedding NanoMQ 0.17.5 as a message broker

Discovery Timeline

2025-07-15 - CVE-2024-42650 published to the National Vulnerability Database (NVD)
2025-07-17 - Last updated in NVD database

Technical Details for CVE-2024-42650

Vulnerability Analysis

The vulnerability is a segmentation fault triggered during MQTT PUBLISH message handling inside pub_handler.c. NanoMQ parses incoming MQTT control packets and dispatches them to handler routines for processing. When a malformed PUBLISH packet reaches this routine, the broker dereferences invalid memory and the process crashes.

The MQTT protocol exposes the broker on TCP port 1883 by default, or 8883 when TLS is enabled. Because the parsing fault occurs before any authentication or authorization checks complete the publish workflow, the attacker requires no valid credentials. Each crafted packet terminates the broker, and any reconnect-on-crash supervision can be exhausted by repeated packets.

The NVD entry classifies the weakness as NVD-CWE-noinfo, reflecting that the upstream issue describes the crash without enumerating a specific memory-safety root cause. The public discussion in GitHub Issue #1168 and Pull Request #1170 tracks the fix.

Root Cause

The root cause is improper validation of fields within an attacker-controlled MQTT PUBLISH packet inside pub_handler.c. Insufficient bounds or null checks lead to an invalid pointer dereference, producing a segmentation fault (SIGSEGV) that terminates the broker.

Attack Vector

Exploitation requires only network reachability to the NanoMQ listener. The attacker establishes an MQTT connection and transmits a crafted PUBLISH packet. No authentication, user interaction, or elevated privileges are required. The vulnerability mechanism is documented in the upstream issue tracker — see the GitHub Issue Discussion for technical reproduction details.

Detection Methods for CVE-2024-42650

Indicators of Compromise

Unexpected NanoMQ process termination with SIGSEGV entries in system logs or dmesg
Repeated broker restarts under supervisors such as systemd, supervisord, or container orchestrators
MQTT clients reporting sudden TCP resets on ports 1883 or 8883 followed by reconnection storms
Inbound MQTT traffic from unexpected source addresses preceding crash events

Detection Strategies

Monitor the NanoMQ process lifecycle and alert on abnormal exit codes or repeated restarts.
Parse broker and kernel logs for segmentation fault signatures tied to the nanomq binary.
Inspect MQTT traffic with a protocol-aware tool to identify malformed PUBLISH packets with anomalous length fields or topic structures.

Monitoring Recommendations

Forward broker logs, host crash logs, and MQTT listener metrics to a centralized analytics platform for correlation.
Track connection rates and per-source publish patterns to identify scanning or exploitation attempts.
Establish a baseline for normal MQTT client behavior and alert on sudden deviations in packet size or message frequency.

How to Mitigate CVE-2024-42650

Immediate Actions Required

Upgrade NanoMQ to a release that incorporates the fix tracked in Pull Request #1170.
Restrict network access to the MQTT listener so only trusted clients and gateways can reach ports 1883 and 8883.
Enable MQTT authentication and TLS to reduce the population of clients capable of submitting PUBLISH packets.
Deploy process supervision with rate-limited restarts to slow exploitation impact while patching.

Patch Information

The upstream fix is tracked in the NanoMQ repository. Review the patch in GitHub Pull Request #1170 and rebuild or upgrade to a release that contains the merged change. Source and release artifacts are available at the NanoMQ GitHub repository.

Workarounds

Place NanoMQ behind a network firewall or MQTT-aware proxy that validates packet structure before forwarding.
Limit broker exposure to internal networks or VPNs until the patched version is deployed.
Apply per-client rate limits and connection quotas on the listener to reduce the volume of malformed packets a single source can deliver.

bash

# Restrict MQTT listener exposure with iptables until patched
iptables -A INPUT -p tcp --dport 1883 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 1883 -j DROP
iptables -A INPUT -p tcp --dport 8883 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8883 -j DROP