Vulnerability details
CVE-2026-58210
nats-io nats-server
NATS Server: MQTT partial CONNECT packets can exhaust pre-auth memory
CVSS 3.1
7.5High
Official description
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, an unauthenticated MQTT client could cause the server to retain large incomplete MQTT CONNECT packets before authentication completed, consuming server memory while the parser waited for the advertised MQTT packet length. This issue is fixed in versions 2.14.3 and 2.12.12.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.5High | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| nats-io | nats-server | < 2.12.12 | CVEProject cvelistV5 (CNA) |
| nats-io | nats-server | >= 2.14.0-RC.1, < 2.14.3 | CVEProject cvelistV5 (CNA) |
References and advisories
5- https://github.com/nats-io/nats-server/security/advisories/GHSA-r72h-j7qq-v6qg x_refsource_CONFIRM
- https://github.com/nats-io/nats-server/commit/bce9ef39469e610aeddb819194ceb7f7edfc0861 x_refsource_MISC
- https://github.com/nats-io/nats-server/commit/e016e47bbf70304945f2ae9dc397e4862adefaf5 x_refsource_MISC
- https://github.com/nats-io/nats-server/releases/tag/v2.12.12 x_refsource_MISC
- https://github.com/nats-io/nats-server/releases/tag/v2.14.3 x_refsource_MISC
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-07-08
- Last updated
- 2026-07-09
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
0.74%
Probability of exploitation in 30 days
54.8%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-400Uncontrolled Resource Consumption