CVE-2026-32135 — NanoMQ has Heap Buffer Overflow in URI Parameter Parsing
NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Versions prior to 0.24.11 have a remotely triggerable heap buffer overflow in the `uri_param_parse` functio…
Published: 2026-04-20 · CVSS: 7.7 · CVSS 4.0
NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Versions prior to 0.24.11 have a remotely triggerable heap buffer overflow in the `uri_param_parse` function of NanoMQ's REST API. The vulnerability occurs due to an off-by-one error when allocating memory for query parameter keys and values, allowing an attacker to write a null byte beyond the allocated buffer. This can be triggered via a crafted HTTP request. Version 0.24.11 patches the issue.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7