CVE-2025-68699

NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In version 0.24.6, NanoMQ has a protocol parsing / forwarding inconsistency when handling shared subscriptions ($share/). A malformed SUBSCRIBE topic such as $share/ab (missing the second /) is not strictly validated during the subscription stage, so the invalid Topic Filter is stored into the subscription table. Later, when any PUBLISH matches this subscription, the broker send path (nmq_pipe_send_start_v4/v5) performs a second $share/ parsing using strchr() and increments the returned pointer without NULL checks. If the second strchr() returns NULL, sub_topic++ turns the pointer into an invalid address (e.g. 0x1). This invalid pointer is then passed into topic_filtern(), which triggers strlen() and crashes with SIGSEGV. The crash is stable and remotely triggerable. This issue has been patched in version 0.24.7.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/nanomq/nanomq/commit/89d68d678e7f841ae7baa45cba8d9bc7ddc9ef4b	Patch
https://github.com/nanomq/nanomq/security/advisories/GHSA-qv5f-c6v2-2f8h	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:emqx:nanomq:0.24.6:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-02-04 20:16

Updated : 2026-02-20 21:20

NVD link : CVE-2025-68699

Mitre link : CVE-2025-68699

CVE.ORG link : CVE-2025-68699

JSON object : View

Products Affected

emqx

nanomq

CWE

CWE-476

NULL Pointer Dereference

{"id": "CVE-2025-68699", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2026-02-04T20:16:03.910", "references": [{"url": "https://github.com/nanomq/nanomq/commit/89d68d678e7f841ae7baa45cba8d9bc7ddc9ef4b", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nanomq/nanomq/security/advisories/GHSA-qv5f-c6v2-2f8h", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In version 0.24.6, NanoMQ has a protocol parsing / forwarding inconsistency when handling shared subscriptions ($share/). A malformed SUBSCRIBE topic such as $share/ab (missing the second /) is not strictly validated during the subscription stage, so the invalid Topic Filter is stored into the subscription table. Later, when any PUBLISH matches this subscription, the broker send path (nmq_pipe_send_start_v4/v5) performs a second $share/ parsing using strchr() and increments the returned pointer without NULL checks. If the second strchr() returns NULL, sub_topic++ turns the pointer into an invalid address (e.g. 0x1). This invalid pointer is then passed into topic_filtern(), which triggers strlen() and crashes with SIGSEGV. The crash is stable and remotely triggerable. This issue has been patched in version 0.24.7."}, {"lang": "es", "value": "NanoMQ MQTT Broker (NanoMQ) es una Plataforma de Mensajer\u00eda de Borde integral. En la versi\u00f3n 0.24.6, NanoMQ presenta una inconsistencia en el an\u00e1lisis / reenv\u00edo de protocolos al manejar suscripciones compartidas ($share/). Un tema SUBSCRIBE malformado como $share/ab (falta la segunda /) no se valida estrictamente durante la etapa de suscripci\u00f3n, por lo que el Topic Filter inv\u00e1lido se almacena en la tabla de suscripciones. Posteriormente, cuando cualquier PUBLISH coincide con esta suscripci\u00f3n, la ruta de env\u00edo del broker (nmq_pipe_send_start_v4/v5) realiza un segundo an\u00e1lisis de $share/ usando strchr() e incrementa el puntero devuelto sin comprobaciones de NULL. Si el segundo strchr() devuelve NULL, sub_topic++ convierte el puntero en una direcci\u00f3n inv\u00e1lida (p. ej., 0x1). Este puntero inv\u00e1lido se pasa entonces a topic_filtern(), lo que activa strlen() y provoca un fallo con SIGSEGV. El fallo es estable y se puede activar remotamente. Este problema ha sido parcheado en la versi\u00f3n 0.24.7."}], "lastModified": "2026-02-20T21:20:09.270", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:emqx:nanomq:0.24.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "64B88C36-7B4D-4BD9-A237-65EFAC5DD520"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}