CVE-2026-32134 (GCVE-0-2026-32134)
Vulnerability from cvelistv5 – Published: 2026-05-19 17:22 – Updated: 2026-05-19 18:01
VLAI
EPSS
VEX
Title
NanoMQ: NULL Pointer Dereference Crash in tcptran_pipe_peer During Session Restore
Summary
NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In versions 0.24.10 and below, when NanoMQ handles high-concurrency reconnect traffic using a reconnect-collision payload, the broker can crash due to a NULL pointer dereference during MQTT session resumption for clean_start=0 clients. The transport's p_peer callback (tcptran_pipe_peer()) iterates cpipe->subinfol while copying session metadata from the cached old pipe to the new reconnecting pipe, without checking whether the pointer is NULL. Under a reconnect race, cpipe->subinfol can be freed and set to NULL before session restore invokes this function, resulting in a remote unauthenticated Denial-of-Service (process crash) condition. This issue has been fixed in version 0.24.11.
Severity
5.9 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-476 - NULL Pointer Dereference
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/nanomq/nanomq/security/advisor… | x_refsource_CONFIRM |
| https://github.com/nanomq/nanomq/issues/2241 | x_refsource_MISC |
| https://github.com/nanomq/NanoNNG/commit/522ec62e… | x_refsource_MISC |
| https://github.com/nanomq/nanomq/releases/tag/0.24.11 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-32134",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-19T17:58:24.262200Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-19T18:01:45.428Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/nanomq/nanomq/security/advisories/GHSA-q36f-83mh-pcv2"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/nanomq/nanomq/issues/2241"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "nanomq",
"vendor": "nanomq",
"versions": [
{
"status": "affected",
"version": "\u003c 0.24.11"
}
]
},
{
"product": "NanoNNG",
"vendor": "nanomq",
"versions": [
{
"status": "affected",
"version": "\u003c 0.24.11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In versions 0.24.10 and below, when NanoMQ handles high-concurrency reconnect traffic using a reconnect-collision payload, the broker can crash due to a NULL pointer dereference during MQTT session resumption for clean_start=0 clients. The transport\u0027s p_peer callback (tcptran_pipe_peer()) iterates cpipe-\u003esubinfol while copying session metadata from the cached old pipe to the new reconnecting pipe, without checking whether the pointer is NULL. Under a reconnect race, cpipe-\u003esubinfol can be freed and set to NULL before session restore invokes this function, resulting in a remote unauthenticated Denial-of-Service (process crash) condition. This issue has been fixed in version 0.24.11."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476: NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-19T17:22:13.431Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/nanomq/nanomq/security/advisories/GHSA-q36f-83mh-pcv2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/nanomq/nanomq/security/advisories/GHSA-q36f-83mh-pcv2"
},
{
"name": "https://github.com/nanomq/nanomq/issues/2241",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nanomq/nanomq/issues/2241"
},
{
"name": "https://github.com/nanomq/NanoNNG/commit/522ec62e29e60d1122f2aedaa6e702dcf089f7bb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nanomq/NanoNNG/commit/522ec62e29e60d1122f2aedaa6e702dcf089f7bb"
},
{
"name": "https://github.com/nanomq/nanomq/releases/tag/0.24.11",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nanomq/nanomq/releases/tag/0.24.11"
}
],
"source": {
"advisory": "GHSA-q36f-83mh-pcv2",
"discovery": "UNKNOWN"
},
"title": "NanoMQ: NULL Pointer Dereference Crash in tcptran_pipe_peer During Session Restore"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-32134",
"datePublished": "2026-05-19T17:22:13.431Z",
"dateReserved": "2026-03-10T22:19:36.546Z",
"dateUpdated": "2026-05-19T18:01:45.428Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-32134",
"date": "2026-08-03",
"epss": "0.00401",
"percentile": "0.3288"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-32134\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-05-19T18:16:21.147\",\"lastModified\":\"2026-07-24T12:10:00.210\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In versions 0.24.10 and below, when NanoMQ handles high-concurrency reconnect traffic using a reconnect-collision payload, the broker can crash due to a NULL pointer dereference during MQTT session resumption for clean_start=0 clients. The transport\u0027s p_peer callback (tcptran_pipe_peer()) iterates cpipe-\u003esubinfol while copying session metadata from the cached old pipe to the new reconnecting pipe, without checking whether the pointer is NULL. Under a reconnect race, cpipe-\u003esubinfol can be freed and set to NULL before session restore invokes this function, resulting in a remote unauthenticated Denial-of-Service (process crash) condition. This issue has been fixed in version 0.24.11.\"},{\"lang\":\"es\",\"value\":\"NanoMQ MQTT Broker (NanoMQ) es una plataforma de mensajer\u00eda de borde integral. En las versiones 0.24.10 e inferiores, cuando NanoMQ maneja tr\u00e1fico de reconexi\u00f3n de alta concurrencia utilizando una carga \u00fatil de colisi\u00f3n de reconexi\u00f3n, el broker puede fallar debido a una desreferenciaci\u00f3n de puntero NULL durante la reanudaci\u00f3n de la sesi\u00f3n MQTT para clientes con clean_start=0. La devoluci\u00f3n de llamada p_peer del transporte (tcptran_pipe_peer()) itera cpipe -\u003e subinfol mientras copia metadatos de sesi\u00f3n desde la tuber\u00eda antigua en cach\u00e9 a la nueva tuber\u00eda de reconexi\u00f3n, sin verificar si el puntero es NULL. Bajo una condici\u00f3n de carrera de reconexi\u00f3n, cpipe -\u003e subinfol puede ser liberado y establecido en NULL antes de que la restauraci\u00f3n de la sesi\u00f3n invoque esta funci\u00f3n, resultando en una condici\u00f3n de Denegaci\u00f3n de Servicio remota no autenticada (fallo del proceso). Este problema ha sido solucionado en la versi\u00f3n 0.24.11.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"nanomq\",\"product\":\"nanomq\",\"versions\":[{\"version\":\"\u003c 0.24.11\",\"status\":\"affected\"}]},{\"vendor\":\"nanomq\",\"product\":\"NanoNNG\",\"versions\":[{\"version\":\"\u003c 0.24.11\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-05-19T17:58:24.262200Z\",\"id\":\"CVE-2026-32134\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"references\":[{\"url\":\"https://github.com/nanomq/NanoNNG/commit/522ec62e29e60d1122f2aedaa6e702dcf089f7bb\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/nanomq/nanomq/issues/2241\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/nanomq/nanomq/releases/tag/0.24.11\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/nanomq/nanomq/security/advisories/GHSA-q36f-83mh-pcv2\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/nanomq/nanomq/issues/2241\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"},{\"url\":\"https://github.com/nanomq/nanomq/security/advisories/GHSA-q36f-83mh-pcv2\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
"redhat_vex": {
"current_release_date": "2026-06-05T19:35:49+00:00",
"cve": "CVE-2026-32134",
"id": "CVE-2026-32134",
"initial_release_date": "2026-01-01T00:00:00+00:00",
"product_status:known_not_affected": "1",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "NanoMQ: NULL Pointer Dereference Crash in tcptran_pipe_peer During Session Restore",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32134.json",
"version": "3"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-32134\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-19T17:58:24.262200Z\"}}}], \"references\": [{\"url\": \"https://github.com/nanomq/nanomq/security/advisories/GHSA-q36f-83mh-pcv2\", \"tags\": [\"exploit\"]}, {\"url\": \"https://github.com/nanomq/nanomq/issues/2241\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-19T17:57:26.470Z\"}}], \"cna\": {\"title\": \"NanoMQ: NULL Pointer Dereference Crash in tcptran_pipe_peer During Session Restore\", \"source\": {\"advisory\": \"GHSA-q36f-83mh-pcv2\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.9, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"nanomq\", \"product\": \"nanomq\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 0.24.11\"}]}, {\"vendor\": \"nanomq\", \"product\": \"NanoNNG\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 0.24.11\"}]}], \"references\": [{\"url\": \"https://github.com/nanomq/nanomq/security/advisories/GHSA-q36f-83mh-pcv2\", \"name\": \"https://github.com/nanomq/nanomq/security/advisories/GHSA-q36f-83mh-pcv2\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/nanomq/nanomq/issues/2241\", \"name\": \"https://github.com/nanomq/nanomq/issues/2241\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/nanomq/NanoNNG/commit/522ec62e29e60d1122f2aedaa6e702dcf089f7bb\", \"name\": \"https://github.com/nanomq/NanoNNG/commit/522ec62e29e60d1122f2aedaa6e702dcf089f7bb\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/nanomq/nanomq/releases/tag/0.24.11\", \"name\": \"https://github.com/nanomq/nanomq/releases/tag/0.24.11\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In versions 0.24.10 and below, when NanoMQ handles high-concurrency reconnect traffic using a reconnect-collision payload, the broker can crash due to a NULL pointer dereference during MQTT session resumption for clean_start=0 clients. The transport\u0027s p_peer callback (tcptran_pipe_peer()) iterates cpipe-\u003esubinfol while copying session metadata from the cached old pipe to the new reconnecting pipe, without checking whether the pointer is NULL. Under a reconnect race, cpipe-\u003esubinfol can be freed and set to NULL before session restore invokes this function, resulting in a remote unauthenticated Denial-of-Service (process crash) condition. This issue has been fixed in version 0.24.11.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-476\", \"description\": \"CWE-476: NULL Pointer Dereference\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-05-19T17:22:13.431Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-32134\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-19T18:01:45.428Z\", \"dateReserved\": \"2026-03-10T22:19:36.546Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-05-19T17:22:13.431Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
Loading…
Loading…