A critical vulnerability in NanoMQ v0.22.7 allows unauthenticated attackers to cause a Denial of Service by exhausting system resources.

This vulnerability involves improper resource throttling within the broker, where a crafted sequence of requests saturates the receive queue. This action forces the exhaustion of system file descriptors, resulting in an unauthenticated remote attacker triggering a process crash.

The exploitation of this flaw results in a complete loss of availability for the affected NanoMQ broker. Given the CVSS score of 7.5, this high severity issue poses a significant risk to operational continuity, as attackers can disrupt message queuing services, leading to potential data flow interruptions and system downtime for downstream applications.

Immediate Action: Monitor official NanoMQ repositories for the release of a patched version and apply the update as soon as it becomes available.

Proactive Monitoring: Review system logs for unusual patterns of rapid connection requests or spikes in file descriptor usage that may indicate an attempt to trigger this exhaustion condition.

Compensating Controls: Implement strict network-level rate limiting or use a Web Application Firewall to filter traffic, which may help mitigate the impact of the crafted request sequences used to exploit this flaw.

Public Exploit Available: Yes — a proof-of-concept exists as documented in the provided GitHub Gist reference.

Organizations utilizing NanoMQ v0.22.7 must prioritize the mitigation of this Denial of Service risk. Until a vendor patch is released, ensure that the broker is not exposed to untrusted networks and implement rigorous ingress traffic controls to prevent the malicious request sequences required to crash the service.