CVE-2025-66023

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-66023
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66023.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-66023
Aliases
  • GHSA-24f7-q5hh-27hf
Published
2026-01-01T15:11:46.028Z
Modified
2026-04-12T18:47:04.738606Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H CVSS Calculator
Summary
NanoMQ has Use-After-Free of malformed bridging message
Details

NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Versions prior to 0.24.5 have a Heap-Use-After-Free (UAF) vulnerability within the MQTT bridge client component (implemented via the underlying NanoNNG library). The vulnerability is triggered when NanoMQ acts as a bridge connecting to a remote MQTT broker. A malicious remote broker can trigger a crash (Denial of Service) or potential memory corruption by accepting the connection and immediately sending a malformed packet sequence. Version 0.34.5 contains a patch. The patch enforces stricter protocol adherence in the MQTT client SDK embedded in NanoMQ. Specifically, it ensures that CONNACK is always the first packet processed in the line. This prevents the state confusion that led to the Heap-Use-After-Free (UAF) when a malicious server sent a malformed packet sequence immediately after connection establishment. As a workaround, validate the remote broker before bridging.

Database specific 
{
    "cwe_ids": [
        "CWE-416"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66023.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/emqx/nanomq

Affected ranges

Type
GIT
Repo
https://github.com/emqx/nanomq
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
9aa4184107a2914c28fbcc7523e79c260c7ed455
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.24.5"
        }
    ]
}

Affected versions

0.*
0.0.1
0.0.2
0.0.3
0.1.0
0.10.1
0.10.5
0.10.8
0.11.0
0.11.2
0.11.3
0.11.5
0.11.8
0.11.82
0.12.0
0.12.1
0.12.2
0.12.5
0.13.0
0.13.6
0.13.8
0.14.0
0.14.1
0.14.5
0.14.8
0.15.0
0.15.1
0.15.2
0.15.3
0.15.5
0.16.0
0.16.2
0.16.3
0.16.5
0.17.2
0.17.5
0.17.8
0.18.1
0.18.2
0.19.0
0.19.1
0.19.5
0.2.0
0.2.1
0.2.2
0.2.5
0.20.0
0.20.5
0.20.6
0.20.8
0.21
0.21.1
0.21.10
0.21.2
0.21.5
0.21.6
0.21.7
0.21.8
0.21.9
0.22.0
0.22.1
0.22.10
0.22.2
0.22.3
0.22.6
0.22.7
0.22.8
0.23.0
0.23.1
0.23.10
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.23.7
0.23.7-11
0.23.8
0.23.9
0.24.0
0.24.1
0.24.2
0.24.3
0.24.3-5
0.24.4
0.3.0
0.3.2
0.3.3
0.3.4
0.3.5
0.3.8
0.4.0
0.4.1
0.4.2
0.4.3
0.4.5
0.4.8
0.5.0
0.5.2
0.5.5
0.5.8
0.5.9
0.6.0
0.6.2
0.6.3
0.6.4
0.6.7rc
0.6.8
0.7.0
0.7.2
0.7.3
0.7.4
0.7.4rc
0.7.5
0.7.5rc
0.7.8
0.7.9
0.8.0
0.8.3
0.8.5
0.8.6log
0.9.0
0.9.2
0.9.5
0.9.7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66023.json"

Git / github.com/nanomq/nanonng

Affected ranges

Type
GIT
Repo
https://github.com/nanomq/nanonng
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
275fde204f7a016df84061a04d3589b2187cb31b
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.24.5"
        }
    ]
}

Affected versions

0.*
0.11.5
0.11.8
0.13
0.13.5
0.14.5
0.15.3
0.15.5
0.16.0
0.16.3
0.16.5
0.17.0
0.17.2
0.17.8
0.18.2
0.19.1
0.20.0
0.20.5
0.20.8
0.21
0.21.2
0.21.5
0.21.6
0.21.8
0.21.9
0.22.0
0.22.1
0.22.10
0.22.2
0.22.4
0.22.6
0.22.8
0.23.1
0.23.10
0.23.2
0.23.3
0.23.5
0.23.7
0.23.8
0.23.9
0.24.0
0.24.1
0.24.2
0.24.3
0.7.2
0.8.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66023.json"
vanir_signatures_modified 
"2026-04-12T18:47:04Z"
vanir_signatures 
[
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 492.0,
            "function_hash": "56958626050329748148744694782009079053"
        },
        "source": "https://github.com/nanomq/nanonng/commit/275fde204f7a016df84061a04d3589b2187cb31b",
        "id": "CVE-2025-66023-0db4bda9",
        "signature_type": "Function",
        "target": {
            "function": "nmq_auth_http_connect",
            "file": "src/sp/protocol/mqtt/auth_http.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "268744193594522080992789612994293258128",
                "165483405537291653127563453155465090727",
                "11041369829816520293312476607410976249",
                "200821478271691919481984153438780605738",
                "182918512030391085661898188106651969207",
                "155900464470709235180528595405603622432",
                "83744376971184402277615564536661587888",
                "299293793255995443923095284851123065377"
            ]
        },
        "source": "https://github.com/nanomq/nanonng/commit/275fde204f7a016df84061a04d3589b2187cb31b",
        "id": "CVE-2025-66023-100549fe",
        "signature_type": "Line",
        "target": {
            "file": "src/sp/protocol/mqtt/mqtt_parser.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 4303.0,
            "function_hash": "77124182106383610417933581188056284634"
        },
        "source": "https://github.com/nanomq/nanonng/commit/275fde204f7a016df84061a04d3589b2187cb31b",
        "id": "CVE-2025-66023-1d6e7a94",
        "signature_type": "Function",
        "target": {
            "function": "nano_pipe_start",
            "file": "src/sp/protocol/mqtt/nmq_mqtt.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 959.0,
            "function_hash": "324400666998203739011331393572365511190"
        },
        "source": "https://github.com/nanomq/nanonng/commit/275fde204f7a016df84061a04d3589b2187cb31b",
        "id": "CVE-2025-66023-345d6db1",
        "signature_type": "Function",
        "target": {
            "function": "verify_connect",
            "file": "src/sp/protocol/mqtt/mqtt_parser.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "164364262414377812650440499958546893940",
                "263184712662825869420828817159095455479",
                "311682571783189142684444126853966489232",
                "302117340673154377291795646925030157741"
            ]
        },
        "source": "https://github.com/nanomq/nanonng/commit/275fde204f7a016df84061a04d3589b2187cb31b",
        "id": "CVE-2025-66023-7d81996a",
        "signature_type": "Line",
        "target": {
            "file": "src/sp/protocol/mqtt/nmq_mqtt.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "305832552049203021059605737312590760524",
                "87605694297252626267185771004794202008",
                "42304555775663366555327629855562317099",
                "209815075214257963700087979711085484635"
            ]
        },
        "source": "https://github.com/nanomq/nanonng/commit/275fde204f7a016df84061a04d3589b2187cb31b",
        "id": "CVE-2025-66023-a1059424",
        "signature_type": "Line",
        "target": {
            "file": "src/sp/protocol/mqtt/auth_http.c"
        }
    }
]