CVE-2025-68699: NanoMQ MQTT Broker DOS Vulnerability

CVE-2025-68699 Overview

CVE-2025-68699 is a Null Pointer Dereference vulnerability affecting NanoMQ MQTT Broker, an all-around Edge Messaging Platform. The vulnerability exists in version 0.24.6 due to improper validation of shared subscription topic filters. When a malformed SUBSCRIBE topic such as $share/ab (missing the second /) is processed, the broker fails to properly validate the Topic Filter during the subscription stage, leading to a remotely triggerable crash.

Critical Impact

This vulnerability allows remote attackers to cause a denial of service condition by sending malformed MQTT SUBSCRIBE messages, causing the broker to crash with a SIGSEGV signal.

Affected Products

• NanoMQ MQTT Broker version 0.24.6
• NanoMQ Edge Messaging Platform (versions prior to 0.24.7)

Discovery Timeline

• 2026-02-04 - CVE-2025-68699 published to NVD
• 2026-02-05 - Last updated in NVD database

Technical Details for CVE-2025-68699

Vulnerability Analysis

The vulnerability stems from a protocol parsing and forwarding inconsistency when handling shared subscriptions using the $share/ prefix. The NanoMQ broker fails to strictly validate Topic Filters during the subscription stage, allowing malformed topics to be stored in the subscription table.

The core issue occurs in the nmq_pipe_send_start_v4/v5 functions, where the broker's send path performs a secondary $share/ parsing using strchr(). When processing the stored invalid subscription, the code increments the returned pointer without performing NULL checks. If the second strchr() call returns NULL (due to the missing second / delimiter), the sub_topic++ operation transforms the pointer into an invalid address (e.g., 0x1). This invalid pointer is subsequently passed to topic_filtern(), which invokes strlen() on the corrupted address, resulting in a SIGSEGV crash.

Root Cause

The root cause is classified as CWE-476 (NULL Pointer Dereference). The vulnerability originates from missing NULL pointer validation in the shared subscription topic parsing logic within sub_handler.c. The code assumes that strchr() will always find a second / delimiter when parsing $share/ topics, but this assumption fails when processing malformed subscription requests that lack the required topic structure.

Attack Vector

The attack is network-based and can be triggered remotely by any client capable of sending MQTT SUBSCRIBE messages. An attacker does not need authentication in many NanoMQ deployments to exploit this vulnerability. The attack sequence involves:

1. Connecting to the NanoMQ broker via MQTT
2. Sending a SUBSCRIBE request with a malformed shared subscription topic (e.g., $share/ab without a trailing /topic)
3. Triggering a PUBLISH message that matches the subscription pattern
4. The broker crashes when attempting to forward the message

// Security patch from sub_handler.c
// Source: https://github.com/nanomq/nanomq/commit/89d68d678e7f841ae7baa45cba8d9bc7ddc9ef4b

 			log_warn("Invalid share topic in subscription!");
 			return PROTOCOL_ERROR;
 		}
-		char *name_end  = strchr(tn->topic.body+7, '/');
+		char *name_end  = strchr(tn->topic.body + 7, '/');
+		if (name_end == NULL) {
+			log_warn("Invalid share name in subscription!");
+			tn->reason_code = MALFORMED_PACKET;
+			return PROTOCOL_ERROR;
+		}
 		log_info("Sub to share name %.*s", name_end - (tn->topic.body + 7), (tn->topic.body+7));
 		char *mark1 = strchr(tn->topic.body + 7, '#');
 		char *mark2 = strchr(tn->topic.body + 7, '+');

Source: GitHub Commit

Detection Methods for CVE-2025-68699

Indicators of Compromise

• MQTT SUBSCRIBE requests containing malformed $share/ topics without proper delimiter structure
• Broker process crashes with SIGSEGV signals
• Core dumps showing crashes in topic_filtern() or related string processing functions
• Abnormal subscription patterns in broker logs containing incomplete shared subscription paths

Detection Strategies

• Monitor MQTT broker logs for "Invalid share topic in subscription!" or similar validation warnings
• Implement network-level inspection for MQTT SUBSCRIBE packets containing $share/ prefixes without complete topic structures
• Set up process monitoring to detect unexpected NanoMQ broker restarts or crashes
• Deploy application-layer firewalls to validate MQTT message structure before reaching the broker

Monitoring Recommendations

• Enable verbose logging on NanoMQ to capture subscription validation events
• Configure alerting for broker process terminations and automatic restart events
• Monitor system logs for SIGSEGV signals associated with the NanoMQ process
• Track subscription patterns for anomalies in shared subscription topic formats

How to Mitigate CVE-2025-68699

Immediate Actions Required

• Upgrade NanoMQ MQTT Broker to version 0.24.7 or later immediately
• Review broker access controls to limit which clients can send SUBSCRIBE requests
• Implement network segmentation to restrict access to the MQTT broker from untrusted networks
• Enable enhanced logging to detect exploitation attempts before and after patching

Patch Information

The vulnerability has been patched in NanoMQ version 0.24.7. The fix adds proper NULL pointer validation after the strchr() call in sub_handler.c, returning a PROTOCOL_ERROR with MALFORMED_PACKET reason code when invalid shared subscription topics are detected.

For detailed patch information, refer to:

• GitHub Security Advisory
• GitHub Commit

Workarounds

• Implement MQTT message filtering at the network perimeter to reject malformed $share/ subscriptions
• Configure authentication requirements to prevent anonymous clients from subscribing
• Deploy a reverse proxy or MQTT gateway that validates subscription topic formats before forwarding
• Consider temporarily disabling shared subscription support if not required for operations

# Configuration example - Restricting broker access via firewall
# Limit MQTT access to trusted networks only
iptables -A INPUT -p tcp --dport 1883 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 1883 -j DROP

# Enable authentication in nanomq.conf to prevent anonymous access
# auth.enable = true
# auth.deny_anonymous = true