CVE-2026-73863

NanoMQ is an MQTT broker. Prior to 0.24.14, NanoMQ's broker-side MQTT v5 nmq_subinfo_decode() function in nng/src/sp/protocol/mqtt/mqtt_parser.c reuses len_of_varint from the outer Properties Length while parsing each SUBSCRIPTION_IDENTIFIER. A remote client can send a SUBSCRIBE packet with a multi-byte Properties Length and repeated subscription identifiers, causing get_var_integer() to begin at an incorrect offset and read beyond the heap message buffer. The flaw is reachable through the broker receive path and can crash the broker, while the separately reported topic-option off-by-one occurs later and is not this vulnerability. This issue is fixed in version 0.24.14.

• CWE-125

• https://github.com/nanomq/NanoNNG/commit/f888fe39d6691b253ff9aee598ce58bbe449ab6f
• https://github.com/nanomq/NanoNNG/pull/1518
• https://github.com/nanomq/nanomq/releases/tag/0.24.14
• https://github.com/nanomq/nanomq/security/advisories/GHSA-pf97-vm7h-q84m
• https://github.com/nanomq/nanomq/security/advisories/GHSA-pf97-vm7h-q84m

Published

Sep 18, 2026

Last Modified

Sep 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-73849Emlog is an open source website building system. In 2.6.26 a…9.8
• CVE-2026-7385The Decent Comments WordPress plugin before 3.0.2 does not r…5.8
• CVE-2026-73850Emlog is an open source website building system. In 2.6.20 a…8.6
• CVE-2026-73851Kiota is an OpenAPI based HTTP Client code generator. Prior …6.1
• CVE-2026-73858Solspace Freeform plugin for Craft CMS 5.x is a super flexib…5.3
• CVE-2026-7386A flaw has been found in fatbobman mail-mcp-bridge up to 1.3…7.3
• CVE-2026-73865Vulnerability in the Helidon product of Oracle Fusion Middle…9.1
• CVE-2026-73866Vulnerability in the Helidon product of Oracle Fusion Middle…9.1
• CVE-2026-73867Vulnerability in the Helidon product of Oracle Fusion Middle…6.5
• CVE-2026-73868Vulnerability in the Helidon product of Oracle Fusion Middle…6.5
• CVE-2026-73869Vulnerability in the Helidon product of Oracle Fusion Middle…6.1
• CVE-2026-7387Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.1…8.8