NATS-Server versions prior to 2.11.14 and 2.12.5 contain a vulnerability where enabling the 'leafnode' configuration with compression active allows any unauthenticated remote user to connect and trigger a panic, causing the server to crash. This is due to a NULL pointer dereference and improper handling of compressed data. The issue occurs before authentication and requires compression, which is enabled by default with leafnodes. The vulnerability leads to a denial of service by crashing the server. Fixed in versions 2.11.14 and 2.12.5. The Red Hat advisory confirms the impact and notes no fully satisfactory mitigation meeting their criteria is currently available, other than upgrading or disabling compression on the leafnode port.

The vulnerability allows unauthenticated remote attackers to cause a denial of service by crashing the nats-server when leafnode and compression are enabled. This results in server unavailability and potential disruption of messaging services relying on nats-server. There is no impact on confidentiality or integrity, but availability is severely affected. The CVSS v3.1 base score is 7.5 (High), reflecting network attack vector, low complexity, no privileges or user interaction required, and high impact on availability.

A fix is available in nats-server versions 2.11.14 and 2.12.5. Users should upgrade to these or later versions to remediate the vulnerability. As a workaround, disabling compression on the leafnode port can prevent exploitation, though this may affect performance or functionality. The Red Hat advisory notes that no mitigation fully meets their criteria except upgrading. Users should consult the vendor advisory and apply the official fixes. No other mitigations are recommended.