CVE-2026-34608

CVE-2026-34608 is an out-of-bounds read vulnerability affecting NanoMQ MQTT Broker versions prior to 0.24.10. This flaw occurs in the hook_work_cb() function when processing nng messages, where cJSON_Parse() attempts to read beyond the allocated buffer due to a missing null terminator in the message body. Rated Medium severity with a CVSS score of 4.9, this vulnerability has a network attack vector and low attack complexity, but requires high privileges. Successful exploitation could lead to a high impact on availability, potentially causing denial of service. There is currently no evidence of active exploitation, nor is any public exploit code available in Metasploit, Nuclei, or ExploitDB, indicating low public attention.