Description
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.12.8 and 2.11.17, an unauthenticated peer with network access to a leafnode listener with compression enabled could crash the server during the pre-authentication leafnode handshake by sending repeated leafnode INFO protocol messages before authentication and account setup completed. This issue is fixed in versions 2.12.8 and 2.11.17.
Published: 2026-07-08
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

NATS Server suffers a crash during the pre‑authentication leafnode handshake when an unauthenticated peer repeatedly sends leafnode INFO protocol messages before authentication and account setup. This leads to a server crash, resulting in service disruption for all connections.

Affected Systems

The vulnerability affects NATS Server from the nats-io vendor. All releases prior to version 2.12.8 and 2.11.17 are impacted. The issue is resolved in releases 2.12.8 and 2.11.17 and later.

Risk and Exploitability

The CVSS score of 7.5 indicates a high‑severity denial‑of‑service flaw. The exploit requires unauthenticated network access to a leafnode listener with compression enabled, which is typically available to external peers. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation yet. Nonetheless, an attacker with network reach to the affected port could intentionally trigger the crash and disrupt availability.

Generated by OpenCVE AI on July 9, 2026 at 15:34 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade NATS Server to version 2.12.8 or later, or to 2.11.17 or later.
  • If an immediate upgrade is not possible, disable compression for all leafnode connections to prevent the crash trigger.
  • Restrict network access to leafnode listeners so only trusted and authenticated peers can connect.

Generated by OpenCVE AI on July 9, 2026 at 15:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 09 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 08 Jul 2026 20:15:00 +0000

Type Values Removed Values Added
Description NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.12.8 and 2.11.17, an unauthenticated peer with network access to a leafnode listener with compression enabled could crash the server during the pre-authentication leafnode handshake by sending repeated leafnode INFO protocol messages before authentication and account setup completed. This issue is fixed in versions 2.12.8 and 2.11.17.
Title NATS Server: Pre-auth server crash via double INFO in leafnode handshake
Weaknesses CWE-476
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-09T13:33:45.059Z

Reserved: 2026-06-29T21:54:30.330Z

Link: CVE-2026-58250

cve-icon Vulnrichment

Updated: 2026-07-09T13:33:39.593Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-09T15:45:06Z

Weaknesses