CVE-2026-58210

Published: Jul 8, 2026Modified: Jul 13, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, an unauthenticated MQTT client could cause the server to retain large incomplete MQTT CONNECT packets before authentication completed, consuming server memory while the parser waited for the advertised MQTT packet length. This issue is fixed in versions 2.14.3 and 2.12.12.

Affected (2)

Products: Linuxfoundation: Nats Server

Linuxfoundation

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Linuxfoundation Nats Server	Before 2.12.12
Linuxfoundation Nats Server	From 2.14.0 to 2.14.3

Related CWEs

Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

References (5)

https://github.com/nats-io/nats-server/commit/bce9ef39469e610aeddb819194ceb7f7edfc0861

Source: security-advisories@github.com

Patch

https://github.com/nats-io/nats-server/commit/e016e47bbf70304945f2ae9dc397e4862adefaf5

Source: security-advisories@github.com

Patch

https://github.com/nats-io/nats-server/releases/tag/v2.12.12

Source: security-advisories@github.com

Release Notes

https://github.com/nats-io/nats-server/releases/tag/v2.14.3

Source: security-advisories@github.com

Release Notes

https://github.com/nats-io/nats-server/security/advisories/GHSA-r72h-j7qq-v6qg

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.