Vulnerability · Published Jul 20, 2026 · Assigned by GitHub_M

CVE-2026-47276NULL Pointer Dereference in REST API properties_parse via Malformed user_properties

Medium 6.5

In plain English

A medium-severity null pointer dereference in nanomq from nanomq. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 64.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in `properties_parse()` allows an authenticated attacker to crash the NanoMQ broker by sending a POST request to `/api/v4/mqtt/publish` with `user_properties` as a JSON array instead of a JSON object. The crash occurs because `strlen()` is called on a NULL `item->string` pointer when iterating over array elements. An authenticated attacker can exploit this to crash the NanoMQ broker process. This is patched in version 0.24.14.

Affected products (as reported)

Vendor	Product	Versions
nanomq	nanomq	<= 0.24.11

Weakness: CWE-476 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/nanomq/nanomq/security/advisories/GHSA-qq2v-xvxg-3hvf x_refsource_CONFIRM