CVE-2026-34608

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34608", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-30T17:15:52.500Z", "datePublished": "2026-04-02T17:52:51.813Z", "dateUpdated": "2026-04-02T19:10:58.813Z"}, "containers": {"cna": {"title": "nanomq: Heap-Buffer-Overflow in webhook_inproc.c via cJSON_Parse OOB Read", "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "lang": "en", "description": "CWE-125: Out-of-bounds Read", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-457", "lang": "en", "description": "CWE-457: Use of Uninitialized Variable", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/nanomq/nanomq/security/advisories/GHSA-8p57-jxj9-3qq3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nanomq/nanomq/security/advisories/GHSA-8p57-jxj9-3qq3"}, {"name": "https://github.com/nanomq/nanomq/commit/9499a4b2c47998a6aadb69238c18b9e6771b1691", "tags": ["x_refsource_MISC"], "url": "https://github.com/nanomq/nanomq/commit/9499a4b2c47998a6aadb69238c18b9e6771b1691"}, {"name": "https://github.com/nanomq/nanomq/releases/tag/0.24.10", "tags": ["x_refsource_MISC"], "url": "https://github.com/nanomq/nanomq/releases/tag/0.24.10"}], "affected": [{"vendor": "nanomq", "product": "nanomq", "versions": [{"version": "< 0.24.10", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-02T17:52:51.813Z"}, "descriptions": [{"lang": "en", "value": "NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to version 0.24.10, in NanoMQ's webhook_inproc.c, the hook_work_cb() function processes nng messages by parsing the message body with cJSON_Parse(body). The body is obtained from nng_msg_body(msg), which is a binary buffer without a guaranteed null terminator. This leads to an out-of-bounds read (OOB read) as cJSON_Parse reads until it finds a \\0, potentially accessing memory beyond the allocated buffer (e.g., nng_msg metadata or adjacent heap/stack). The issue is often masked by nng's allocation padding (extra 32 bytes of zeros for non-power-of-two sizes <1024 or non-aligned). The overflow is reliably triggered when the JSON payload length is a power-of-two >=1024 (no padding added). This issue has been patched in version 0.24.10."}], "source": {"advisory": "GHSA-8p57-jxj9-3qq3", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-02T19:10:50.684727Z", "id": "CVE-2026-34608", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-02T19:10:58.813Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34608", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-02T19:10:50.684727Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-02T19:10:55.411Z"}}], "cna": {"title": "nanomq: Heap-Buffer-Overflow in webhook_inproc.c via cJSON_Parse OOB Read", "source": {"advisory": "GHSA-8p57-jxj9-3qq3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "nanomq", "product": "nanomq", "versions": [{"status": "affected", "version": "< 0.24.10"}]}], "references": [{"url": "https://github.com/nanomq/nanomq/security/advisories/GHSA-8p57-jxj9-3qq3", "name": "https://github.com/nanomq/nanomq/security/advisories/GHSA-8p57-jxj9-3qq3", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/nanomq/nanomq/commit/9499a4b2c47998a6aadb69238c18b9e6771b1691", "name": "https://github.com/nanomq/nanomq/commit/9499a4b2c47998a6aadb69238c18b9e6771b1691", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nanomq/nanomq/releases/tag/0.24.10", "name": "https://github.com/nanomq/nanomq/releases/tag/0.24.10", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to version 0.24.10, in NanoMQ's webhook_inproc.c, the hook_work_cb() function processes nng messages by parsing the message body with cJSON_Parse(body). The body is obtained from nng_msg_body(msg), which is a binary buffer without a guaranteed null terminator. This leads to an out-of-bounds read (OOB read) as cJSON_Parse reads until it finds a \\0, potentially accessing memory beyond the allocated buffer (e.g., nng_msg metadata or adjacent heap/stack). The issue is often masked by nng's allocation padding (extra 32 bytes of zeros for non-power-of-two sizes <1024 or non-aligned). The overflow is reliably triggered when the JSON payload length is a power-of-two >=1024 (no padding added). This issue has been patched in version 0.24.10."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125: Out-of-bounds Read"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-457", "description": "CWE-457: Use of Uninitialized Variable"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-02T17:52:51.813Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34608", "state": "PUBLISHED", "dateUpdated": "2026-04-02T19:10:58.813Z", "dateReserved": "2026-03-30T17:15:52.500Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-02T17:52:51.813Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "nanomq", "vendor": "nanomq", "versions": [{"status": "affected", "version": "< 0.24.10"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:emqx:nanomq:*:*:*:*:*:*:*:*", "matchCriteriaId": "FE31E670-F1FF-49F4-8937-96E87F9DAC1F", "versionEndExcluding": "0.24.10", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to version 0.24.10, in NanoMQ's webhook_inproc.c, the hook_work_cb() function processes nng messages by parsing the message body with cJSON_Parse(body). The body is obtained from nng_msg_body(msg), which is a binary buffer without a guaranteed null terminator. This leads to an out-of-bounds read (OOB read) as cJSON_Parse reads until it finds a \\0, potentially accessing memory beyond the allocated buffer (e.g., nng_msg metadata or adjacent heap/stack). The issue is often masked by nng's allocation padding (extra 32 bytes of zeros for non-power-of-two sizes <1024 or non-aligned). The overflow is reliably triggered when the JSON payload length is a power-of-two >=1024 (no padding added). This issue has been patched in version 0.24.10."}, {"lang": "es", "value": "NanoMQ MQTT Broker (NanoMQ) es una Plataforma de Mensajer\u00eda de Borde integral. Antes de la versi\u00f3n 0.24.10, en webhook_inproc.c de NanoMQ, la funci\u00f3n hook_work_cb() procesa mensajes nng analizando el cuerpo del mensaje con cJSON_Parse(body). El cuerpo se obtiene de nng_msg_body(msg), que es un b\u00fafer binario sin un terminador nulo garantizado. Esto conduce a una lectura fuera de l\u00edmites (OOB read) ya que cJSON_Parse lee hasta que encuentra un \\0, accediendo potencialmente a memoria m\u00e1s all\u00e1 del b\u00fafer asignado (por ejemplo, metadatos de nng_msg o heap/stack adyacente). El problema a menudo est\u00e1 enmascarado por el relleno de asignaci\u00f3n de nng (32 bytes adicionales de ceros para tama\u00f1os que no son potencias de dos <1024 o no alineados). El desbordamiento se activa de forma fiable cuando la longitud de la carga \u00fatil JSON es una potencia de dos >=1024 (sin relleno a\u00f1adido). Este problema ha sido parcheado en la versi\u00f3n 0.24.10."}], "id": "CVE-2026-34608", "lastModified": "2026-07-24T21:10:00.143", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34608", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-02T19:10:50.684727Z", "version": "2.0.3"}}]}, "published": "2026-04-02T18:16:32.357", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/nanomq/nanomq/commit/9499a4b2c47998a6aadb69238c18b9e6771b1691"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/nanomq/nanomq/releases/tag/0.24.10"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/nanomq/nanomq/security/advisories/GHSA-8p57-jxj9-3qq3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-457"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.24.10)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "nanomq", "source": "cna", "vendor": "nanomq"}, "product": "nanomq", "vendor": "nanomq"}], "analysis": {"en": {"generated_at": "2026-04-15T08:22:56.774573+00:00", "value": {"mitigation_remediation": ["Upgrade NanoMQ to version 0.24.10 or later.", "If an upgrade is not immediately possible, constrain the maximum JSON payload size to less than 1024 bytes or enforce null\u2011termination before parsing.", "Continuously monitor broker logs for anomalous JSON parsing errors or crashes."], "summary": {"action": "Immediate Patch", "impact": "Out-of-bounds read (possible information disclosure)"}, "threat_synthesis": {"affected_systems": "Affected systems include all NanoMQ releases prior to 0.24.10, as identified in the advisories and the cpe listing for nanomq:nanomq. The name of the product is simply NanoMQ MQTT Broker.", "description_and_impact": "NanoMQ MQ\u00adBroker\u2019s webhook_inproc.c routine parses incoming messages with cJSON_Parse, which expects a null-terminated string. The message body obtained through nng_msg_body(msg) is a raw binary buffer that may lack a terminating zero. When the payload size is a power of two that is at least 1024 bytes, the buffer receives no padding, causing cJSON_Parse to read beyond the buffer until it encounters a zero byte. This out\u2011of\u2011bounds read can expose contents of adjacent memory or trigger a crash, depending on the data accessed, and constitutes a CWE\u2011125 weakness. The issue is fixed in release 0.24.10.\n\nAffected systems include all NanoMQ releases prior to 0.24.10, as identified in the advisories and the cpe listing for nanomq:nanomq. The name of the product is simply NanoMQ MQTT Broker.", "risk_and_exploitability": "Risk and exploitability: The CVSS v3 score is 4.9, indicating moderate severity, while the EPSS score is below 1%, suggesting a low probability of exploitation. The vulnerability is not listed in CISA\u2019s KEV catalog. The likely exploitation requires an attacker to send a specially crafted JSON payload of a power\u2011of\u2011two length (\u22651024 bytes) to the broker\u2019s webhook interface; the broker must be reachable from the attacking network. Because the attack vector relies on sending payloads of a specific size, the exploitation is feasible but not trivially ubiquitous."}}}}, "created": "2026-04-03T07:32:09.158161+00:00", "updated": "2026-04-15T16:30:09.777523+00:00", "vendors": ["nanomq", "nanomq$PRODUCT$nanomq"]}