{"id":"CVE-2026-44640","aliases":["EUVD-2026-33428","GHSA-9fgw-v323-jmjj"],"status":"published","title":"NanoMQ: QUIC Dialer Close Type Confusion","description":"NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to 0.24.14, aio-\u003eprov_data is stored as nni_quic_conn* during dialing, but read as ex_quic_conn* during dialer close. This type confusion causes invalid object interpretation and leads to close-path hang/crash behavior. This vulnerability is fixed in 0.24.14.","severity":{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00096,"percentile":0.0068,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-843"],"published":"2026-05-29T19:28:47Z","modified":"2026-11-04T02:47:34Z","products":[{"vendor":"nanomq","product":"nanomq"}],"references":[{"url":"https://github.com/nanomq/nanomq/security/advisories/GHSA-9fgw-v323-jmjj","tags":["x_refsource_CONFIRM","exploit","advisory"]},{"url":"https://github.com/nanomq/nanomq/releases/tag/0.24.14","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44640.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44640","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-44640","title":"NanoMQ: QUIC Dialer Close Type Confusion","description":"NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to 0.24.14, aio-\u003eprov_data is stored as nni_quic_conn* during dialing, but read as ex_quic_conn* during dialer close. This type confusion causes invalid object interpretation and leads to close-path hang/crash behavior. This vulnerability is fixed in 0.24.14.","status":"published","published":"2026-05-29T19:28:47.185Z","modified":"2026-05-29T21:36:48.164Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-843"],"updated_at":"2026-11-02T13:42:49.132798Z"}],"euvd":[{"id":"EUVD-2026-33428","description":"NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to 0.24.14, aio-\u003eprov_data is stored as nni_quic_conn* during dialing, but read as ex_quic_conn* during dialer close. This type confusion causes invalid object interpretation and leads to close-path hang/crash behavior. This vulnerability is fixed in 0.24.14.","status":"published","published":"2026-05-29T19:28:47Z","modified":"2026-05-29T21:36:48Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T18:20:59.967985Z"}],"nvd":[{"id":"CVE-2026-44640","description":"NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to 0.24.14, aio-\u003eprov_data is stored as nni_quic_conn* during dialing, but read as ex_quic_conn* during dialer close. This type confusion causes invalid object interpretation and leads to close-path hang/crash behavior. This vulnerability is fixed in 0.24.14.","status":"published","published":"2026-05-29T20:16:24.983Z","modified":"2026-07-22T06:10:00.17Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-843"],"updated_at":"2026-11-02T14:12:21.635958Z"}],"osv":[{"id":"CVE-2026-44640","title":"NanoMQ: QUIC Dialer Close Type Confusion","description":"NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to 0.24.14, aio-\u003eprov_data is stored as nni_quic_conn* during dialing, but read as ex_quic_conn* during dialer close. This type confusion causes invalid object interpretation and leads to close-path hang/crash behavior. This vulnerability is fixed in 0.24.14.","status":"published","published":"2026-05-29T19:28:47.185Z","modified":"2026-11-08T02:47:35.472449767Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-843"],"updated_at":"2026-11-08T02:57:14.556074Z"}]}}