**CVE Number**：CVE-2024-42646

**Vulnerability Type:** Segmentation Fault

**Vulnerability Version**：

- NanoMQ （git commit #ffd0e7b）

**Vulnerability Impact**：

This vulnerability allows a remote attacker to cause a segmentation fault in the NanoMQ broker (commit `ffd0e7b`) by sending a specially crafted network packet. Upon processing the malformed input, the broker dereferences an invalid memory address, leading to a crash. This results in a denial-of-service (DoS) condition, as the broker process terminates unexpectedly. No prior authentication is required to exploit this issue, making it a low-complexity but high-impact vulnerability in environments where NanoMQ is exposed to untrusted clients.

**Function Stack Information**：

![image-20250712141757472](CVE-2024-42646.assets/image-20250712141757472.png)

**Reproduce**：

nanomq start --conf ../../etc/nanomq.conf

nc 127.0.0.1 1883 < ./poc.raw

![img](CVE-2024-42646.assets/image.png)