CVE-2026-21888

Katalog CVE

CVSS 7.5 · High EPSS 0,31%

Kerentanan Out-of-bounds Read pada emqx nanomq. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. MQTT v5 Variable Byte Integer parsing out-of-bounds: get_var_integer() accepts 5-byte varints without bounds checks; reliably triggers OOB read / crash when built with ASan. This affects 0.24.6 and earlier.

Rincian

Terbit di NVD

11 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-125: Out-of-bounds Read

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 22,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nanomq/nanomq/security/advisories/GHSA-cggc-6m7w-j7x5 exploit · advisory vendor
• https://github.com/nanomq/nanomq/issues/2192 issue tracking