NanoMQ Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in NanoMQ version 0.22.7. This issue allows attackers to send a large number of crafted MQTT packets to the NanoMQ broker, causing the 'recv-q' queue to fill up rapidly. This accumulation leads to a deadlock, exhausting file descriptor resources and causing the broker to become unresponsive, unable to provide normal services.

Impact

Exploitation of this vulnerability leads to a deadlock in the NanoMQ broker, causing it to become unresponsive and unable to provide normal services. Additionally, the vulnerability causes file descriptor exhaustion, which can further disrupt the broker's functionality.

Reproduction

To reproduce this vulnerability, send a high volume of malicious MQTT packets to the NanoMQ broker. This can be done using an MQTT client or a custom script that targets the broker's MQTT endpoint. Monitor the 'recv-q' queue and the broker's response to observe the deadlock and service disruption.