What is CVE-2026-35217?

CVE-2026-35217 is a medium-severity vulnerability in Nanomq, classified under Out-of-bounds Read. CVSS score: 6.5/10. Published 2026-07-20.

How severe is CVE-2026-35217?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Out-of-bounds Read in Nanomq

CVE-2026-35217

NanoMQ contains a protocol-semantics flaw in its MQTT v5 `SUBSCRIBE` handling: if a subscription entry is missing the final 1-byte `Subscription Options` field, the broker may still accept the malformed packet and install the subscription…

Vulnerability class: Buffer Overflow

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H.

Affected products

Nanomq — versions <= 0.24.14

Weakness classification (CWE)

CWE-125 — Out-of-bounds Read

References

security-advisories@github.com (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2026-35217?: CVE-2026-35217 is a medium-severity vulnerability in Nanomq, classified under Out-of-bounds Read. CVSS score: 6.5/10. Published 2026-07-20.
How severe is CVE-2026-35217?: Medium severity. CVSS v3 base score is 6.5 out of 10.