Vulnerability details

CVE-2026-58207

nats-io nats-server

NATS Server: Remote crash via integer overflow in Connz pagination

CVSS 3.1

7.7High

Official description

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, a client able to send account-scoped connection monitoring requests could crash the server by supplying Connz pagination Offset and Limit values that overflowed internal arithmetic before the response window was safely bounded. This issue is fixed in versions 2.14.3 and 2.12.12.

CVSS scores

Score	Version	Source	Vector
7.7High	3.1	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H`

Affected products

Vendor	Product	Versions	Source
nats-io	nats-server	< 2.12.12	CVEProject cvelistV5 (CNA)
nats-io	nats-server	>= 2.14.0-RC.1, < 2.14.3	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/nats-io/nats-server/security/advisories/GHSA-q59r-vq66-pxc2 x_refsource_CONFIRM
https://github.com/nats-io/nats-server/commit/2ae047139e37a38cb01e259a67909e7a39fa38e9 x_refsource_MISC
https://github.com/nats-io/nats-server/commit/894d9411927681d66ce349bf1afe49608dc0c1a3 x_refsource_MISC
https://github.com/nats-io/nats-server/releases/tag/v2.12.12 x_refsource_MISC
https://github.com/nats-io/nats-server/releases/tag/v2.14.3 x_refsource_MISC

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-07-08
Last updated: 2026-07-09
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.56%

Probability of exploitation in 30 days

46.8%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Partial

Weaknesses (CWE)

CWE-190
Integer Overflow or Wraparound