CVE-2026-61633 NanoMQ: Infinite Loop in UNSUBSCRIBE Decoder Leading to Remote DoS
A malicious MQTT broker can cause a NanoMQ client to hang and consume resources via a malformed UNSUBSCRIBE packet, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-61633?
CVE-2026-61633 is a low-severity denial of service vulnerability in nanomq, published on 18 Sep 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
NanoMQ is an MQTT broker. Prior to 0.24.14, the NanoMQ client function nni_mqtt_msg_decode_unsubscribe() in nng/src/supplemental/mqtt/mqtt_codec.c does not handle a failed read_uint16() while counting topics in a malformed UNSUBSCRIBE packet. A zero-length topic followed by trailing data can leave buf.curpos unchanged while topic_count continues to increase, allowing a malicious MQTT broker to hang a connecting MQTT 3.1.1 client, consume CPU and memory, and repeatedly deny service when automatic reconnection is enabled. The broker-side nmq_unsubinfo_decode path is not affected. This issue is fixed in version 0.24.14.
Weakness: CWE-835
Which versions are affected by CVE-2026-61633?
How do I fix CVE-2026-61633?
No fix has been published for CVE-2026-61633 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-61633 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-61633 exists.
Sources
Also known as GHSA-m7mp-rr3v-hmhr.