CVE-2026-32696

Low

Description

NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In NanoMQ version 0.24.6, after enabling auth.http_auth (HTTP authentication), when a client connects to the broker using MQTT CONNECT without providing username/password, and the configuration params uses the placeholders %u / %P (e.g., username="%u", password="%P"), the HTTP request construction phase enters auth_http.c:set_data(). This results in calling strlen() on a NULL pointer, causing a SIGSEGV crash. This crash can be triggered remotely, resulting in a denial of service. This issue has been patched in version 0.24.7.

SeverityLow

CVSS3.1

Exploit probability—

ProductEmqx Nanomq

PublishedMar 30, 2026

First seenMar 30, 2026

Weakness typeCWE-476NULL pointer dereference

How to fix

Update

emqx nanomq0.24.7 or later

Affected products

Product	Affected versions	Fixed in
emqx nanomq	v < 0.24.7	0.24.7

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.