CVE-2026-35217: NanoMQ Buffer Overflow Vulnerability

CVE-2026-35217 Overview

CVE-2026-35217 is a protocol-parsing vulnerability in NanoMQ, an open-source MQTT broker. The flaw resides in the MQTT v5 SUBSCRIBE packet handler. When a subscription entry omits the required 1-byte Subscription Options field, the broker fails to reject the malformed packet. Instead, it installs the subscription into its internal subinfol state and, under specific packet-length conditions, performs a 1-byte out-of-bounds read past the heap allocation boundary [CWE-125]. The defect has two manifestations from a single root cause: a semantic protocol violation and a verifiable heap-buffer-overflow read detectable by AddressSanitizer.

Critical Impact
A remote, unauthenticated client can send a crafted MQTT v5 SUBSCRIBE packet to trigger an out-of-bounds heap read and corrupt broker subscription state.

Affected Products

NanoMQ MQTT broker
Deployments exposing MQTT v5 SUBSCRIBE handling to untrusted clients
IoT and messaging infrastructure built on NanoMQ

Discovery Timeline

2026-07-20 - CVE-2026-35217 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-35217

Vulnerability Analysis

The vulnerability lives in NanoMQ's MQTT v5 SUBSCRIBE packet parser. MQTT v5 requires each Topic Filter in a SUBSCRIBE payload to be followed by a mandatory 1-byte Subscription Options field. NanoMQ does not enforce this requirement correctly. When the field is missing, the parser reads one byte beyond the intended subscription entry and continues processing the packet as valid.

The consequences are twofold. First, the broker treats a malformed SUBSCRIBE as a successful subscription and appends the entry to its internal subinfol state. This is a semantic violation of the MQTT specification. Second, when the packet length places the missing byte past the end of the underlying heap buffer, the parser performs a 1-byte read outside the real allocation. AddressSanitizer flags this as a heap-buffer-overflow. Both behaviors originate from the same parsing defect.

Root Cause

The root cause is missing bounds validation between the MQTT logical remain length and the actual heap allocation size of the incoming message buffer. The parser advances its cursor to consume the Subscription Options byte without first verifying that the byte falls within the packet payload declared by the client. When the read happens to land on a byte that looks acceptable, parsing continues and the malformed subscription is installed.

Attack Vector

An unauthenticated remote attacker sends a specially constructed MQTT v5 SUBSCRIBE packet in which a subscription entry lacks its trailing Subscription Options byte. The packet-length field is manipulated so the parser reads past the intended entry. Depending on heap layout, the read either corrupts broker subscription state silently or triggers a heap-buffer-overflow condition affecting broker availability. See the GitHub Security Advisory GHSA-w4xh-p384-w556 for technical details.

Detection Methods for CVE-2026-35217

Indicators of Compromise

Unexpected NanoMQ broker crashes or restarts correlated with inbound MQTT v5 SUBSCRIBE traffic
ASAN-instrumented builds reporting heap-buffer-overflow in the SUBSCRIBE parsing path
Presence of subscription entries in subinfol state that do not correspond to well-formed client sessions

Detection Strategies

Enable AddressSanitizer in test and staging builds of NanoMQ to surface out-of-bounds reads during fuzzing
Inspect MQTT v5 SUBSCRIBE packets on the wire for payloads whose declared length does not accommodate the trailing Subscription Options byte for each Topic Filter
Deploy protocol-aware network intrusion detection signatures that validate MQTT v5 SUBSCRIBE payload structure

Monitoring Recommendations

Log all client connections and SUBSCRIBE packet metadata, including source IP, client ID, and payload length
Alert on abnormal broker process termination or memory-related fault signals
Correlate malformed MQTT traffic with authentication and session telemetry to identify probing behavior

How to Mitigate CVE-2026-35217

Immediate Actions Required

Upgrade NanoMQ to a version that includes the fix referenced in GHSA-w4xh-p384-w556
Restrict broker exposure to trusted network segments and require authenticated MQTT clients
Enforce TLS and client certificate validation to reduce the pool of potential attackers

Patch Information

Refer to the NanoMQ GitHub Security Advisory GHSA-w4xh-p384-w556 for patched versions and commit references. Apply the upstream fix as soon as it is available in your deployment channel.

Workarounds

Place NanoMQ behind an MQTT-aware proxy or gateway that validates SUBSCRIBE payload structure before forwarding
Limit inbound MQTT traffic to authenticated clients using access control lists and firewall rules
Disable MQTT v5 support where operationally feasible until the patched version is deployed

bash

# Example: restrict inbound MQTT traffic to a trusted subnet
iptables -A INPUT -p tcp --dport 1883 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 1883 -j DROP
iptables -A INPUT -p tcp --dport 8883 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8883 -j DROP