CVE-2026-44639

Name of the Vulnerable Software and Affected Versions NanoMQ versions prior to 0.24.14

Description The MQTT v5 property decoder in the nng/src/supplemental/mqtt/mqtt codec.c file uses the property append() function to traverse a linked list for every property added by decode buf properties(). A remote unauthenticated client can send PUBLISH or SUBSCRIBE packets containing a large number of User Properties, triggering O(N²) linked-list insertion and excessive CPU consumption. This results in the broker becoming unresponsive, and the denial of service can be sustained through repeated packets.

Recommendations Update to version 0.24.14.