CVE-2026-61633

NanoMQ is an MQTT broker. Prior to 0.24.14, the NanoMQ client function nni_mqtt_msg_decode_unsubscribe() in nng/src/supplemental/mqtt/mqtt_codec.c does not handle a failed read_uint16() while counting topics in a malformed UNSUBSCRIBE packet. A zero-length topic followed by trailing data can leave buf.curpos unchanged while topic_count continues to increase, allowing a malicious MQTT broker to hang a connecting MQTT 3.1.1 client, consume CPU and memory, and repeatedly deny service when automatic reconnection is enabled. The broker-side nmq_unsubinfo_decode path is not affected. This issue is fixed in version 0.24.14.

• CWE-835

• https://github.com/nanomq/NanoNNG/commit/fa8d859bb39841e46cfc6cce280d242bd782ad3d
• https://github.com/nanomq/NanoNNG/pull/1518
• https://github.com/nanomq/nanomq/releases/tag/0.24.14
• https://github.com/nanomq/nanomq/security/advisories/GHSA-m7mp-rr3v-hmhr
• https://github.com/nanomq/nanomq/security/advisories/GHSA-m7mp-rr3v-hmhr

Published

Sep 18, 2026

Last Modified

Sep 18, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-61625VictoriaMetrics is a scalable solution for monitoring and ma…6.8
• CVE-2026-61628nginx ignition is a user interface for the nginx web server.…8.1
• CVE-2026-61629nginx ignition is a user interface for the nginx web server.…7.5
• CVE-2026-6163A vulnerability was identified in code-projects Lost and Fou…7.3
• CVE-2026-61630nginx ignition is a user interface for the nginx web server.…4.2
• CVE-2026-61632PyMdown Extensions is a set of extensions for the Python-Mar…5.3
• CVE-2026-61634The RabbitMQ Java client library allows Java and JVM-based a…0
• CVE-2026-61638Wallos is an open-source, self-hostable personal subscriptio…8.2
• CVE-2026-61639Wallos is an open-source, self-hostable personal subscriptio…8.5
• CVE-2026-6164A security flaw has been discovered in code-projects Lost an…7.3
• CVE-2026-61640Wallos is an open-source, self-hostable personal subscriptio…8.5
• CVE-2026-61641Wallos is an open-source, self-hostable personal subscriptio…8.1