{"id":"CVE-2026-44639","summary":"NanoMQ: O(N²) Denial of Service in MQTT v5 Property Parsing","details":"NanoMQ is an MQTT broker. Prior to 0.24.14, NanoMQ's MQTT v5 property decoder in nng/src/supplemental/mqtt/mqtt_codec.c uses property_append() to walk the entire linked list for each property added by decode_buf_properties(). A remote unauthenticated client can supply a PUBLISH or SUBSCRIBE packet containing many User Properties, causing O(N²) linked-list insertion and CPU work that makes the broker unresponsive; repeated packets can sustain the denial of service. This issue is fixed in version 0.24.14.","aliases":["GHSA-6mwg-445v-2qrv"],"modified":"2026-09-19T08:14:24.708101Z","published":"2026-09-18T16:17:56.222Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-407"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44639.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44639.json"},{"type":"FIX","url":"https://github.com/nanomq/NanoNNG/commit/91bd4c7f45f945a3f5f0e37c459157dc7c277a07"},{"type":"FIX","url":"https://github.com/nanomq/NanoNNG/pull/1508"},{"type":"WEB","url":"https://github.com/nanomq/nanomq/releases/tag/0.24.14"},{"type":"ADVISORY","url":"https://github.com/nanomq/nanomq/security/advisories/GHSA-6mwg-445v-2qrv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44639"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/nanomq/nanonng","events":[{"introduced":"0"},{"fixed":"5c6ad09f0f6f0b111e19e8fbae259d20f5673505"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"0.24.14"}],"source":"AFFECTED_FIELD"}}],"versions":["0.24.13","0.24.12","0.24.11-sdv","0.24.11","0.24.10","0.24.8","0.24.7","0.24.6","0.24.5","0.24.3","0.24.2","0.24.1","0.24.0","0.23.10","0.23.9","0.23.8","0.23.7","0.23.5","0.23.3","0.23.2","0.23.1","0.22.10","0.22.8","0.22.6","0.22.4","0.22.2","0.22.1","0.22.0","0.21.9","0.21.8","0.21.6","0.21.5","0.21.2","0.21","0.20.8","0.20.5","0.20.0","0.18.2","0.19.1","0.17.8","0.17.2","0.17.0","0.16.5","0.16.3","0.16.0","0.15.5","0.15.3","0.14.5","0.13.5","0.13","0.11.8","0.11.5","0.8.3","0.7.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44639.json","vanir_signatures_modified":"2026-09-19T08:14:24Z","vanir_signatures":[{"digest":{"line_hashes":["106732617879992299546335078856304780455","294493632223967332579844525831444462468","206181698616916517217061310250512270723","76067159830892398620980420349741433411","132925112758583824193369990132482553455","55370608497300193109260551169647432186","81972049601563662899808688096955314759","238044452542881528069518046016055915863"],"threshold":0.9},"id":"CVE-2026-44639-1eff8815","signature_type":"Line","signature_version":"v1","source":"https://github.com/nanomq/nanonng/commit/5c6ad09f0f6f0b111e19e8fbae259d20f5673505","target":{"file":"src/supplemental/nanolib/conf.c"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/nanomq/nanonng/commit/5c6ad09f0f6f0b111e19e8fbae259d20f5673505","target":{"file":"src/supplemental/nanolib/conf.c","function":"conf_bridge_node_destroy"},"deprecated":false,"digest":{"function_hash":"179704196006112879465033474608620449237","length":3859},"id":"CVE-2026-44639-bc6d51d1","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["319987710299103814133658779126207238492","70208850574568910157760390157809152789","191324800489073211161864177168034711983","282085166627322855677257736944132808316","295813053496134856364453543700627648562"],"threshold":0.9},"id":"CVE-2026-44639-cdd8af0f","signature_type":"Line","signature_version":"v1","source":"https://github.com/nanomq/nanonng/commit/5c6ad09f0f6f0b111e19e8fbae259d20f5673505","target":{"file":"include/nng/supplemental/nanolib/conf.h"}},{"deprecated":false,"digest":{"function_hash":"60028838494314808152959761740048073868","length":1512},"id":"CVE-2026-44639-fd363509","signature_type":"Function","signature_version":"v1","source":"https://github.com/nanomq/nanonng/commit/5c6ad09f0f6f0b111e19e8fbae259d20f5673505","target":{"file":"src/supplemental/nanolib/conf.c","function":"conf_bridge_node_init"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"}]}