CVE-2026-35217 nanomq CVE debrief

Who should care

Users of NanoMQ, especially those who handle MQTT v5 SUBSCRIBE packets, should be aware of this vulnerability. The flaw could allow an attacker to bypass security checks and potentially lead to a heap-buffer-overflow. Affected operators, platforms, vulnerability-management teams, and security teams should prioritize updating NanoMQ to a version that fixes this vulnerability.

Technical summary

The vulnerability lies in NanoMQ's handling of MQTT v5 SUBSCRIBE packets. If a subscription entry lacks the final 1-byte Subscription Options field, the broker may still accept the packet. This flaw can lead to two issues: a semantic vulnerability where a malformed packet is treated as a successful subscription, and under certain conditions, a verifiable out-of-bounds read vulnerability. The issue arises from the parser's inability to correctly handle malformed subscription entries, which can result in the broker installing a malformed subscription into its internal state. Furthermore, under specific packet-length constructions, this flaw also causes a 1-byte out-of-bounds read that crosses the real heap allocation boundary, detectable by ASAN as a heap-buffer-overflow.

Defensive priority

High priority should be given to updating NanoMQ to a version that fixes this vulnerability. Users should verify their current version and apply patches or updates as soon as available. Implementing compensating controls to monitor MQTT v5 SUBSCRIBE packets and considering temporary disabling of MQTT v5 SUBSCRIBE functionality until a patch is applied are also recommended.

Recommended defensive actions

• Verify current NanoMQ version and check for updates
• Implement compensating controls to monitor MQTT v5 SUBSCRIBE packets
• Consider temporarily disabling MQTT v5 SUBSCRIBE functionality until a patch is applied
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-20T17:17:06.980Z and last modified on 2026-07-20T19:17:21.643Z. The NVD entry is currently 6.5 MEDIUM. Limited details are available about affected versions and patches. The vulnerability was identified in NanoMQ's MQTT v5 SUBSCRIBE handling, specifically in the broker's processing of subscription entries. The issue allows for a semantic vulnerability and, under certain conditions, a verifiable out-of-bounds read vulnerability. Evidence of the vulnerability's existence and impact is grounded in the official CVE record and NVD details.

Official resources