CVE-2026-58210

7.5 Élevée

Publiée le 08/07/2026 à 22:16 · Modifiée le 13/07/2026 à 17:14 · Analysée par le NVD · Source : security-advisories@github.com

Description

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, an unauthenticated MQTT client could cause the server to retain large incomplete MQTT CONNECT packets before authentication completed, consuming server memory while the parser waited for the advertised MQTT packet length. This issue is fixed in versions 2.14.3 and 2.12.12.

Traduire en français

Produits concernés

nats-io nats-server
Linuxfoundation nats-server

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.5 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

Faiblesses (CWE)

CWE-400

Références

https://github.com/nats-io/nats-server/commit/bce9ef39469e610aeddb819194ceb7f7edfc0861 Patch
https://github.com/nats-io/nats-server/commit/e016e47bbf70304945f2ae9dc397e4862adefaf5 Patch
https://github.com/nats-io/nats-server/releases/tag/v2.12.12 Release Notes
https://github.com/nats-io/nats-server/releases/tag/v2.14.3 Release Notes
https://github.com/nats-io/nats-server/security/advisories/GHSA-r72h-j7qq-v6qg Vendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories