CVE-2026-32134

NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In versions 0.24.10 and below, when NanoMQ handles high-concurrency reconnect traffic using a reconnect-collision payload, the broker can crash due to a NULL pointer dereference during MQTT session resumption for clean_start=0 clients. The transport's p_peer callback (tcptran_pipe_peer()) iterates cpipe->subinfol while copying session metadata from the cached old pipe to the new reconnecting pipe, without checking whether the pointer is NULL. Under a reconnect race, cpipe->subinfol can be freed and set to NULL before session restore invokes this function, resulting in a remote unauthenticated Denial-of-Service (process crash) condition. This issue has been fixed in version 0.24.11.

• CWE-476

• https://github.com/nanomq/NanoNNG/commit/522ec62e29e60d1122f2aedaa6e702dcf089f7bb
• https://github.com/nanomq/nanomq/issues/2241
• https://github.com/nanomq/nanomq/releases/tag/0.24.11
• https://github.com/nanomq/nanomq/security/advisories/GHSA-q36f-83mh-pcv2
• https://github.com/nanomq/nanomq/issues/2241
• https://github.com/nanomq/nanomq/security/advisories/GHSA-q36f-83mh-pcv2

Published

May 19, 2026

Last Modified

Jul 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32129soroban-poseidon provides Poseidon and Poseidon2 cryptograph…8.7
• CVE-2026-3213Improper Neutralization of Input During Web Page Generation …4.7
• CVE-2026-32130ZITADEL is an open source identity management platform. From…7.5
• CVE-2026-32131ZITADEL is an open source identity management platform. Prio…7.7
• CVE-2026-32132ZITADEL is an open source identity management platform. Prio…7.4
• CVE-2026-321332FAuth is a web app to manage Two-Factor Authentication (2FA…9.1
• CVE-2026-32135NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging …7.5
• CVE-2026-32136AdGuard Home is a network-wide software for blocking ads and…9.8
• CVE-2026-32137Dataease is an open source data visualization analysis tool.…8.8
• CVE-2026-32138NEXULEAN is a cybersecurity portfolio & service platform for…8.2
• CVE-2026-32139Dataease is an open source data visualization analysis tool.…5.4
• CVE-2026-3214Authentication Bypass Using an Alternate Path or Channel vul…6.5