CVE-2026-32134

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32134", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-10T22:19:36.546Z", "datePublished": "2026-05-19T17:22:13.431Z", "dateUpdated": "2026-05-19T18:01:45.428Z"}, "containers": {"cna": {"title": "NanoMQ: NULL Pointer Dereference Crash in tcptran_pipe_peer During Session Restore", "problemTypes": [{"descriptions": [{"cweId": "CWE-476", "lang": "en", "description": "CWE-476: NULL Pointer Dereference", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/nanomq/nanomq/security/advisories/GHSA-q36f-83mh-pcv2", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nanomq/nanomq/security/advisories/GHSA-q36f-83mh-pcv2"}, {"name": "https://github.com/nanomq/nanomq/issues/2241", "tags": ["x_refsource_MISC"], "url": "https://github.com/nanomq/nanomq/issues/2241"}, {"name": "https://github.com/nanomq/NanoNNG/commit/522ec62e29e60d1122f2aedaa6e702dcf089f7bb", "tags": ["x_refsource_MISC"], "url": "https://github.com/nanomq/NanoNNG/commit/522ec62e29e60d1122f2aedaa6e702dcf089f7bb"}, {"name": "https://github.com/nanomq/nanomq/releases/tag/0.24.11", "tags": ["x_refsource_MISC"], "url": "https://github.com/nanomq/nanomq/releases/tag/0.24.11"}], "affected": [{"vendor": "nanomq", "product": "nanomq", "versions": [{"version": "< 0.24.11", "status": "affected"}]}, {"vendor": "nanomq", "product": "NanoNNG", "versions": [{"version": "< 0.24.11", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-19T17:22:13.431Z"}, "descriptions": [{"lang": "en", "value": "NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In versions 0.24.10 and below, when NanoMQ handles high-concurrency reconnect traffic using a reconnect-collision payload, the broker can crash due to a NULL pointer dereference during MQTT session resumption for clean_start=0 clients. The transport's p_peer callback (tcptran_pipe_peer()) iterates cpipe->subinfol while copying session metadata from the cached old pipe to the new reconnecting pipe, without checking whether the pointer is NULL. Under a reconnect race, cpipe->subinfol can be freed and set to NULL before session restore invokes this function, resulting in a remote unauthenticated Denial-of-Service (process crash) condition. This issue has been fixed in version 0.24.11."}], "source": {"advisory": "GHSA-q36f-83mh-pcv2", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/nanomq/nanomq/security/advisories/GHSA-q36f-83mh-pcv2", "tags": ["exploit"]}, {"url": "https://github.com/nanomq/nanomq/issues/2241", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-19T17:58:24.262200Z", "id": "CVE-2026-32134", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-19T18:01:45.428Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32134", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-19T17:58:24.262200Z"}}}], "references": [{"url": "https://github.com/nanomq/nanomq/security/advisories/GHSA-q36f-83mh-pcv2", "tags": ["exploit"]}, {"url": "https://github.com/nanomq/nanomq/issues/2241", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-19T17:57:26.470Z"}}], "cna": {"title": "NanoMQ: NULL Pointer Dereference Crash in tcptran_pipe_peer During Session Restore", "source": {"advisory": "GHSA-q36f-83mh-pcv2", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "nanomq", "product": "nanomq", "versions": [{"status": "affected", "version": "< 0.24.11"}]}, {"vendor": "nanomq", "product": "NanoNNG", "versions": [{"status": "affected", "version": "< 0.24.11"}]}], "references": [{"url": "https://github.com/nanomq/nanomq/security/advisories/GHSA-q36f-83mh-pcv2", "name": "https://github.com/nanomq/nanomq/security/advisories/GHSA-q36f-83mh-pcv2", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/nanomq/nanomq/issues/2241", "name": "https://github.com/nanomq/nanomq/issues/2241", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nanomq/NanoNNG/commit/522ec62e29e60d1122f2aedaa6e702dcf089f7bb", "name": "https://github.com/nanomq/NanoNNG/commit/522ec62e29e60d1122f2aedaa6e702dcf089f7bb", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nanomq/nanomq/releases/tag/0.24.11", "name": "https://github.com/nanomq/nanomq/releases/tag/0.24.11", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In versions 0.24.10 and below, when NanoMQ handles high-concurrency reconnect traffic using a reconnect-collision payload, the broker can crash due to a NULL pointer dereference during MQTT session resumption for clean_start=0 clients. The transport's p_peer callback (tcptran_pipe_peer()) iterates cpipe->subinfol while copying session metadata from the cached old pipe to the new reconnecting pipe, without checking whether the pointer is NULL. Under a reconnect race, cpipe->subinfol can be freed and set to NULL before session restore invokes this function, resulting in a remote unauthenticated Denial-of-Service (process crash) condition. This issue has been fixed in version 0.24.11."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-476", "description": "CWE-476: NULL Pointer Dereference"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-19T17:22:13.431Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32134", "state": "PUBLISHED", "dateUpdated": "2026-05-19T18:01:45.428Z", "dateReserved": "2026-03-10T22:19:36.546Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-19T17:22:13.431Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "nanomq", "vendor": "nanomq", "versions": [{"status": "affected", "version": "< 0.24.11"}]}, {"product": "NanoNNG", "vendor": "nanomq", "versions": [{"status": "affected", "version": "< 0.24.11"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In versions 0.24.10 and below, when NanoMQ handles high-concurrency reconnect traffic using a reconnect-collision payload, the broker can crash due to a NULL pointer dereference during MQTT session resumption for clean_start=0 clients. The transport's p_peer callback (tcptran_pipe_peer()) iterates cpipe->subinfol while copying session metadata from the cached old pipe to the new reconnecting pipe, without checking whether the pointer is NULL. Under a reconnect race, cpipe->subinfol can be freed and set to NULL before session restore invokes this function, resulting in a remote unauthenticated Denial-of-Service (process crash) condition. This issue has been fixed in version 0.24.11."}, {"lang": "es", "value": "NanoMQ MQTT Broker (NanoMQ) es una plataforma de mensajer\u00eda de borde integral. En las versiones 0.24.10 e inferiores, cuando NanoMQ maneja tr\u00e1fico de reconexi\u00f3n de alta concurrencia utilizando una carga \u00fatil de colisi\u00f3n de reconexi\u00f3n, el broker puede fallar debido a una desreferenciaci\u00f3n de puntero NULL durante la reanudaci\u00f3n de la sesi\u00f3n MQTT para clientes con clean_start=0. La devoluci\u00f3n de llamada p_peer del transporte (tcptran_pipe_peer()) itera cpipe -> subinfol mientras copia metadatos de sesi\u00f3n desde la tuber\u00eda antigua en cach\u00e9 a la nueva tuber\u00eda de reconexi\u00f3n, sin verificar si el puntero es NULL. Bajo una condici\u00f3n de carrera de reconexi\u00f3n, cpipe -> subinfol puede ser liberado y establecido en NULL antes de que la restauraci\u00f3n de la sesi\u00f3n invoque esta funci\u00f3n, resultando en una condici\u00f3n de Denegaci\u00f3n de Servicio remota no autenticada (fallo del proceso). Este problema ha sido solucionado en la versi\u00f3n 0.24.11."}], "id": "CVE-2026-32134", "lastModified": "2026-07-24T12:10:00.210", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32134", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-19T17:58:24.262200Z", "version": "2.0.3"}}]}, "published": "2026-05-19T18:16:21.147", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/nanomq/NanoNNG/commit/522ec62e29e60d1122f2aedaa6e702dcf089f7bb"}, {"source": "security-advisories@github.com", "url": "https://github.com/nanomq/nanomq/issues/2241"}, {"source": "security-advisories@github.com", "url": "https://github.com/nanomq/nanomq/releases/tag/0.24.11"}, {"source": "security-advisories@github.com", "url": "https://github.com/nanomq/nanomq/security/advisories/GHSA-q36f-83mh-pcv2"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/nanomq/nanomq/issues/2241"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/nanomq/nanomq/security/advisories/GHSA-q36f-83mh-pcv2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.24.11)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "nanomq", "source": "cna", "vendor": "nanomq"}, "product": "nanomq", "vendor": "nanomq"}], "created": "2026-05-19T18:30:11.289294+00:00", "updated": "2026-05-19T19:00:11.318869+00:00", "vendors": ["nanomq", "nanomq$PRODUCT$nanomq"]}