PatchSiren cyber security CVE debrief
CVE-2026-44640 nanomq CVE debrief
A type confusion vulnerability in NanoMQ MQTT Broker prior to version 0.24.14 allows invalid object interpretation during dialer close operations. The issue stems from `aio->prov_data` being stored as `nni_quic_conn*` during dialing but read as `ex_quic_conn*` during dialer close, leading to potential hang or crash behavior on the close path. This vulnerability has a CVSS 3.1 score of 4.5 (MEDIUM severity) with a vector of AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L, indicating local attack vector, high attack complexity, no privileges required, user interaction required, and low impacts to confidentiality, integrity, and availability. The weakness is classified as CWE-843 (Access of Resource Using Incompatible Type). The vulnerability was published on May 29, 2026 and fixed in NanoMQ version 0.24.14.
- Vendor
- nanomq
- Product
- Unknown
- CVSS
- MEDIUM 4.5
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-29
- Original CVE updated
- 2026-05-29
- Advisory published
- 2026-05-29
- Advisory updated
- 2026-05-29
Who should care
Organizations running NanoMQ MQTT Broker versions prior to 0.24.14, particularly those using QUIC transport for edge messaging deployments. System administrators and DevOps teams managing IoT or edge computing infrastructure with NanoMQ should prioritize patching. Developers maintaining forks or custom builds of NanoMQ should review the QUIC connection handling code for similar type confusion issues.
Technical summary
NanoMQ MQTT Broker versions prior to 0.24.14 contain a type confusion vulnerability in QUIC connection handling. During the dialing phase, `aio->prov_data` is stored as a pointer to `nni_quic_conn`, but during dialer close operations, the same field is interpreted as `ex_quic_conn*`. This incompatible type access causes invalid object interpretation, resulting in undefined behavior that manifests as hangs or crashes on the connection close path. The vulnerability requires local access and user interaction to trigger, with high attack complexity limiting practical exploitation. The fix in version 0.24.14 ensures consistent type handling throughout the connection lifecycle.
Defensive priority
medium
Recommended defensive actions
- Upgrade NanoMQ to version 0.24.14 or later to remediate this vulnerability
- Review QUIC connection handling code for similar type confusion patterns if maintaining a fork
- Monitor application logs for unexpected hang or crash behavior during connection close operations
- Apply principle of least privilege to limit potential impact of memory safety issues
Evidence notes
The vulnerability description and fix version are sourced from the official CVE record and GitHub Security Advisory. The CVSS vector and CWE classification are provided by the NVD entry.
Official resources
The vulnerability was disclosed through GitHub Security Advisories and the NVD. The fix was released in NanoMQ version 0.24.14 on May 29, 2026.