A high severity memory leak in EMQ NanoMQ version 0.24.9 allows remote attackers to cause a denial of service through improper resource management.

The nni_qos_db_set function in the broker_tcp.c component fails to properly manage memory, allowing a remote attacker to exhaust system resources and crash the broker.

The vulnerability carries a CVSS score of 7.5, justifying its high severity. Successful exploitation results in a denial of service, which can cause significant downtime for applications relying on the NanoMQ broker for message transport.

Immediate Action: Monitor official vendor communication for a patch release. In the absence of a patch, implement rate limiting on connections to the broker to slow down potential resource exhaustion.

Proactive Monitoring: Monitor system memory usage and broker health metrics for signs of rapid degradation or unexplained consumption.

Compensating Controls: Utilize a firewall to limit incoming connections to the broker from known, trusted IP addresses to reduce the likelihood of remote exploitation.

Public Exploit Available: Yes (a proof of concept is available via a public GitHub repository).

The availability of a public proof of concept increases the risk of exploitation. Administrators should isolate the broker from public-facing networks and monitor system resources closely until an official patch is applied.