**CVE Number**：CVE-2024-42649

**Vulnerability Type:** Memory Leak

**Vulnerability Version**：

- NanoMQ 0.22.1

  GIT COMMIT: 70de56cddc87444d120a3a7e477c76a26bca8d56

**Vulnerability Impact**：

This vulnerability allows a remote client to trigger a memory leak in NanoMQ version 0.22.1 (commit `70de56cddc87444d120a3a7e477c76a26bca8d56`) by sending a specially crafted MQTT packet. Upon receiving and processing the malformed input, the broker allocates heap memory that is never released, leading to incremental memory consumption over time. This memory leak can be repeatedly triggered without authentication, potentially resulting in resource exhaustion and denial of service (DoS) on long-running deployments.

**Function Stack Information**：

![image-20250712145322524](CVE-2024-42649.assets/image-20250712145322524.png)

**Reproduce**：

nanomq start --conf ../../etc/nanomq.conf

nc 127.0.0.1 1883 < ./poc.raw