A vulnerability exists in NATS Server where an unauthenticated MQTT client can send an incomplete CONNECT packet that the server retains before authentication finishes. The incomplete packet length is not validated, causing the server to allocate memory while waiting for the advertised length. This results in a denial of service when an attacker floods the broker with many such packets, eventually exhausting server memory. The weakness maps to CWE‑400, a denial of resource condition. The impact is loss of availability and potential service disruption on the affected broker instances.

The issue affects the NATS Server product from nats‑io. All versions prior to 2.14.3 and prior to 2.12.12 are vulnerable because the memory exhaustion handling was corrected in those releases. Users running any older flagship releases should verify the installed version and plan an update.

The CVSS score is 7.5, indicating a high severity vulnerability. The EPSS score is less than 1%, and the vulnerability is not listed in CISA’s KEV catalog, suggesting a low current exploitation probability at the time of analysis. The likely attack vector is a network‑based attacker who can connect to the broker over MQTT, using unauthenticated access to send fragmented CONNECT packets. Since the flaw is triggered by input to the parser, it is achievable by anyone who can reach the MQTT port for a broker.