PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45151 nanomq CVE debrief

A null pointer dereference vulnerability exists in NanoMQ MQTT Broker versions 0.24.8 and earlier. The flaw occurs in the `quic_stream_recv` function when a QUIC substream is in a reopen state, causing the code to dereference a null substream pointer. While the function finishes the asynchronous I/O operation with an error, it fails to return before attempting to lock `c->mtx`, leading to potential undefined behavior. The CVSS 4.0 score of 2.9 (Low severity) reflects the attack complexity requirements and limited availability impact. The vulnerability is classified as CWE-476 (NULL Pointer Dereference). No known exploitation in the wild or ransomware campaign use has been reported.

Vendor
nanomq
Product
Unknown
CVSS
LOW 2.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-29
Original CVE updated
2026-07-22
Advisory published
2026-05-29
Advisory updated
2026-07-22

Who should care

Organizations running NanoMQ MQTT Broker 0.24.8 or earlier for IoT or edge messaging infrastructure, particularly those exposing QUIC-enabled MQTT services to untrusted networks.

Technical summary

The vulnerability exists in the QUIC stream receive handling code of NanoMQ. When a substream enters a reopen state, the `quic_stream_recv` function may encounter a null substream pointer. The error handling path completes the AIO with an error status but proceeds to mutex lock operations without proper return, creating a race condition or crash scenario. The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L) indicates network accessibility with high attack complexity and low availability impact.

Defensive priority

low

Recommended defensive actions

  • Upgrade NanoMQ MQTT Broker to a version newer than 0.24.8 when available
  • Monitor NanoMQ GitHub repository for security patches addressing GHSA-9qhf-wgp4-p7w5
  • Review QUIC stream handling code in custom NanoMQ deployments for similar null pointer patterns
  • Implement network segmentation to limit exposure of MQTT broker services
  • Enable crash monitoring and logging to detect potential null pointer dereference attempts

Evidence notes

Vulnerability description and technical details sourced from NVD record and GitHub Security Advisory. CVSS 4.0 vector confirms network attack vector with high attack complexity. Vendor attribution to NanoMQ project based on GitHub advisory reference.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45151 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45151

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45151 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45151

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.