CVE-2025-68699: NanoMQ MQTT Broker DOS Vulnerability

CVE-2025-68699 Overview

CVE-2025-68699 is a Null Pointer Dereference vulnerability affecting NanoMQ MQTT Broker, an all-around Edge Messaging Platform. The vulnerability exists in version 0.24.6 due to improper validation of shared subscription topic filters. When a malformed SUBSCRIBE topic such as $share/ab (missing the second /) is processed, the broker fails to properly validate the Topic Filter during the subscription stage, leading to a remotely triggerable crash.

Critical Impact
This vulnerability allows remote attackers to cause a denial of service condition by sending malformed MQTT SUBSCRIBE messages, causing the broker to crash with a SIGSEGV signal.

Affected Products

NanoMQ MQTT Broker version 0.24.6
NanoMQ Edge Messaging Platform (versions prior to 0.24.7)

Discovery Timeline

2026-02-04 - CVE-2025-68699 published to NVD
2026-02-05 - Last updated in NVD database

Technical Details for CVE-2025-68699

Vulnerability Analysis

The vulnerability stems from a protocol parsing and forwarding inconsistency when handling shared subscriptions using the $share/ prefix. The NanoMQ broker fails to strictly validate Topic Filters during the subscription stage, allowing malformed topics to be stored in the subscription table.

The core issue occurs in the nmq_pipe_send_start_v4/v5 functions, where the broker's send path performs a secondary $share/ parsing using strchr(). When processing the stored invalid subscription, the code increments the returned pointer without performing NULL checks. If the second strchr() call returns NULL (due to the missing second / delimiter), the sub_topic++ operation transforms the pointer into an invalid address (e.g., 0x1). This invalid pointer is subsequently passed to topic_filtern(), which invokes strlen() on the corrupted address, resulting in a SIGSEGV crash.

Root Cause

The root cause is classified as CWE-476 (NULL Pointer Dereference). The vulnerability originates from missing NULL pointer validation in the shared subscription topic parsing logic within sub_handler.c. The code assumes that strchr() will always find a second / delimiter when parsing $share/ topics, but this assumption fails when processing malformed subscription requests that lack the required topic structure.

Attack Vector

The attack is network-based and can be triggered remotely by any client capable of sending MQTT SUBSCRIBE messages. An attacker does not need authentication in many NanoMQ deployments to exploit this vulnerability. The attack sequence involves:

Connecting to the NanoMQ broker via MQTT
Sending a SUBSCRIBE request with a malformed shared subscription topic (e.g., $share/ab without a trailing /topic)
Triggering a PUBLISH message that matches the subscription pattern
The broker crashes when attempting to forward the message

// Security patch from sub_handler.c
// Source: https://github.com/nanomq/nanomq/commit/89d68d678e7f841ae7baa45cba8d9bc7ddc9ef4b

 			log_warn("Invalid share topic in subscription!");
 			return PROTOCOL_ERROR;
 		}
-		char *name_end  = strchr(tn->topic.body+7, '/');
+		char *name_end  = strchr(tn->topic.body + 7, '/');
+		if (name_end == NULL) {
+			log_warn("Invalid share name in subscription!");
+			tn->reason_code = MALFORMED_PACKET;
+			return PROTOCOL_ERROR;
+		}
 		log_info("Sub to share name %.*s", name_end - (tn->topic.body + 7), (tn->topic.body+7));
 		char *mark1 = strchr(tn->topic.body + 7, '#');
 		char *mark2 = strchr(tn->topic.body + 7, '+');

Source: GitHub Commit

Detection Methods for CVE-2025-68699

Indicators of Compromise

MQTT SUBSCRIBE requests containing malformed $share/ topics without proper delimiter structure
Broker process crashes with SIGSEGV signals
Core dumps showing crashes in topic_filtern() or related string processing functions
Abnormal subscription patterns in broker logs containing incomplete shared subscription paths

Detection Strategies

Monitor MQTT broker logs for "Invalid share topic in subscription!" or similar validation warnings
Implement network-level inspection for MQTT SUBSCRIBE packets containing $share/ prefixes without complete topic structures
Set up process monitoring to detect unexpected NanoMQ broker restarts or crashes
Deploy application-layer firewalls to validate MQTT message structure before reaching the broker

Monitoring Recommendations

Enable verbose logging on NanoMQ to capture subscription validation events
Configure alerting for broker process terminations and automatic restart events
Monitor system logs for SIGSEGV signals associated with the NanoMQ process
Track subscription patterns for anomalies in shared subscription topic formats

How to Mitigate CVE-2025-68699

Immediate Actions Required

Upgrade NanoMQ MQTT Broker to version 0.24.7 or later immediately
Review broker access controls to limit which clients can send SUBSCRIBE requests
Implement network segmentation to restrict access to the MQTT broker from untrusted networks
Enable enhanced logging to detect exploitation attempts before and after patching

Patch Information

The vulnerability has been patched in NanoMQ version 0.24.7. The fix adds proper NULL pointer validation after the strchr() call in sub_handler.c, returning a PROTOCOL_ERROR with MALFORMED_PACKET reason code when invalid shared subscription topics are detected.

For detailed patch information, refer to:

Workarounds

Implement MQTT message filtering at the network perimeter to reject malformed $share/ subscriptions
Configure authentication requirements to prevent anonymous clients from subscribing
Deploy a reverse proxy or MQTT gateway that validates subscription topic formats before forwarding
Consider temporarily disabling shared subscription support if not required for operations

bash

# Configuration example - Restricting broker access via firewall
# Limit MQTT access to trusted networks only
iptables -A INPUT -p tcp --dport 1883 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 1883 -j DROP

# Enable authentication in nanomq.conf to prevent anonymous access
# auth.enable = true
# auth.deny_anonymous = true