CVE-2026-44640

Published: May 29, 2026Modified: Jul 22, 2026Deferred

4.5

Vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

Exploitability: 1.0 / Impact: 3.4

Source: security-advisories@github.com (Secondary)

Description

NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to 0.24.14, aio->prov_data is stored as nni_quic_conn* during dialing, but read as ex_quic_conn* during dialer close. This type confusion causes invalid object interpretation and leads to close-path hang/crash behavior. This vulnerability is fixed in 0.24.14.

Related CWEs

CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

References (3)

https://github.com/nanomq/nanomq/releases/tag/0.24.14

Source: security-advisories@github.com

https://github.com/nanomq/nanomq/security/advisories/GHSA-9fgw-v323-jmjj

Source: security-advisories@github.com

https://github.com/nanomq/nanomq/security/advisories/GHSA-9fgw-v323-jmjj

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.