NanoMQ v0.22.10 was discovered to contain a heap overflow which allows attackers to cause a Denial of Service (DoS) via a crafted CONNECT message.
The product writes data past the end, or before the beginning, of the intended buffer.
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
| Link | Tags |
|---|---|
| https://github.com/nanomq/nanomq | product |
| https://github.com/songxpu/bug_report/blob/master/MQTT/NanoMQ/CVE-2024-42648.md | third party advisory exploit |