CVE-2025-68699: 
NixOS vulnerability analysis and mitigation

CVE-2025-68699 is a NULL pointer dereference vulnerability in NanoMQ MQTT Broker (version 0.24.6) caused by a protocol parsing and forwarding inconsistency when handling shared subscriptions ($share/). A malformed SUBSCRIBE topic (e.g., $share/ab, missing the second /) bypasses validation at the subscription stage, and when a subsequent PUBLISH matches the stored invalid filter, the broker's send path dereferences a NULL-incremented pointer, triggering a SIGSEGV crash. The vulnerability was disclosed on February 4, 2026, and has a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is a NULL pointer dereference (CWE-476) arising from a two-stage inconsistency in shared subscription handling. During the SUBSCRIBE phase, sub_handle.c stores a malformed topic like $share/ab (missing the second /) without rejecting it, because the name_end pointer returned by strchr() is not checked for NULL before use. Later, during the PUBLISH forwarding phase in nmq_pipe_send_start_v4/v5 (broker_tcp.c), a second strchr() call searching for the second / returns NULL; the code then unconditionally increments this NULL pointer (sub_topic++), producing an invalid address (e.g., 0x1). This invalid pointer is passed to topic_filtern(), which calls strlen() on it, causing a stable SIGSEGV. The vulnerable code paths exist in both the MQTTv4 (broker_tcp.c:1051–1059) and MQTTv5 (broker_tcp.c:1316–1327) send paths (GitHub Advisory).

Successful exploitation causes a stable, remotely triggerable crash of the NanoMQ broker process (SIGSEGV), resulting in a complete denial of service for all connected MQTT clients and disrupting message delivery across the edge messaging platform. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue. In IoT or industrial edge deployments where NanoMQ serves as a critical message broker, a crash could disrupt sensor data pipelines, device command channels, or real-time telemetry (GitHub Advisory).

A public proof-of-concept (PoC) is included in the GitHub Security Advisory and requires only standard MQTT client tools (mosquitto_sub and mosquitto_pub). The attack requires no authentication and no special privileges, but does require user interaction in the CVSS sense — a client must first establish the malformed subscription before a publish triggers the crash. No in-the-wild exploitation has been reported, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.051% (GitHub Advisory, Feedly).

1. Install MQTT client tools: On an attacker-controlled machine, install mosquitto-clients (e.g., sudo apt install mosquitto-clients).
2. Create a malformed shared subscription: In one terminal, subscribe using a malformed $share/ topic missing the second /:

   mosquitto_sub -h <target-ip> -p 1883 -t '$share/ab' -q 0 -d

   The broker accepts and stores this invalid Topic Filter without rejecting it.
3. Trigger the crash via PUBLISH: In a second terminal, publish a message to the same malformed topic:

   mosquitto_pub -h <target-ip> -p 1883 -t '$share/ab' -m 'x' -q 0

4. Broker crashes: The broker's send path attempts to parse the stored $share/ab topic, the second strchr() returns NULL, sub_topic++ produces address 0x1, and topic_filtern() calls strlen(0x1), triggering SIGSEGV and crashing the broker process (GitHub Advisory).

• Network: MQTT SUBSCRIBE packets containing topic filters matching the pattern $share/<name> without a trailing / and topic (e.g., $share/ab); these can be detected via MQTT-aware network inspection or packet capture on port 1883/8883.
• Logs: NanoMQ broker logs showing log_warn("Invalid share name in subscription!") (post-patch) or absence of such warnings with subsequent broker crash (pre-patch); UBSan output containing runtime error: applying non-zero offset 1 to null pointer at broker_tcp.c:1058.
• Process: Unexpected termination of the nanomq process with signal SIGSEGV; crash dumps or core files referencing __strlen_avx2, topic_filtern, or nmq_pipe_send_start_v4/v5 in the stack trace (GitHub Advisory).

The fix is available in NanoMQ version 0.24.7, which adds a NULL check for name_end after the strchr() call in sub_handler.c; if NULL, the broker now returns a MALFORMED_PACKET error and rejects the subscription (Patch Commit). Users running version 0.24.6 should upgrade to 0.24.7 immediately. As a temporary workaround where upgrading is not immediately possible, restrict MQTT broker access to trusted clients only using network-level controls (firewall rules, VPN, or authentication enforcement) to prevent untrusted clients from sending malformed SUBSCRIBE packets (GitHub Advisory).

The vulnerability was reported by researcher Fuzz0X and published as a GitHub Security Advisory by NanoMQ maintainer JaylinYu on February 4, 2026. Cyfirma included it in their weekly intelligence report for February 13, 2026, noting it as a notable edge messaging platform vulnerability (Cyfirma Report). Red Hat also tracked the CVE in their security database (Red Hat CVE). No significant broader community or social media discussion has been observed.