CVE-2025-59947
📋 TL;DR
NanoMQ versions before 0.24.4 contain a buffer overflow vulnerability when PUBLISH packets trigger both shared and vanilla subscriptions simultaneously. This allows attackers to execute arbitrary code or crash the service. All NanoMQ deployments using affected versions with shared subscriptions enabled are vulnerable.
💻 Affected Systems
- NanoMQ
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or deployment of persistent malware.
Likely Case
Service crash causing denial of service and disruption to IoT messaging operations.
If Mitigated
Limited impact with proper network segmentation and monitoring, potentially just service instability.
🎯 Exploit Status
Exploitation requires crafting specific PUBLISH packets but no authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.24.4
Vendor Advisory: https://github.com/nanomq/nanomq/security/advisories/GHSA-98f4-cmg8-x7f3
Restart Required: Yes
Instructions:
1. Download NanoMQ 0.24.4 or later from official repository. 2. Stop the NanoMQ service. 3. Replace the binary with patched version. 4. Restart the service.
🔧 Temporary Workarounds
Disable Shared Subscriptions
allPrevent the buffer overflow by disabling shared subscription functionality.
Edit NanoMQ configuration file and set 'shared_subscription = false' or remove shared subscription configurations.
🧯 If You Can't Patch
- Implement strict network access controls to limit who can connect to NanoMQ service.
- Deploy intrusion detection systems to monitor for abnormal MQTT traffic patterns.
🔍 How to Verify
Check if Vulnerable:
Check NanoMQ version with 'nanomq --version' and verify it's below 0.24.4, and check if shared subscriptions are enabled in configuration.Check Version:
nanomq --versionVerify Fix Applied:
Confirm version is 0.24.4 or higher with 'nanomq --version' and test shared subscription functionality.📡 Detection & Monitoring
Log Indicators:
- Service crashes, segmentation faults, or abnormal termination logs in NanoMQ logs.
- Unusual PUBLISH packet patterns in MQTT logs.
Network Indicators:
- Abnormal MQTT traffic spikes, malformed PUBLISH packets targeting shared subscriptions.
SIEM Query:
source="nanomq" AND ("segmentation fault" OR "buffer overflow" OR "crash")