CVE-2026-33218: CWE-20: Improper Input Validation in nats-io nats-server
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a client which can connect to the leafnode port can crash the nats-server with a certain malformed message pre-authentication. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, disable leafnode support if not needed or restrict network connections to the leafnode port, if plausible without compromising the service offered.
AI Analysis
Technical Summary
NATS-Server, a high-performance messaging server for NATS.io, contains an improper input validation vulnerability (CWE-20, CWE-1286) in versions before 2.11.15 and 2.12.6. A remote attacker can connect to the leafnode port and send a malformed message pre-authentication that causes the server to crash, resulting in a denial of service (DoS). The vulnerability has a CVSS v3.1 score of 7.5 (high severity) with network attack vector, low complexity, no privileges or user interaction required, and impacts availability only. Red Hat advisory confirms the issue and notes that no easy mitigation meeting their criteria is available, recommending upgrading to fixed versions or applying workarounds such as disabling leafnode support or restricting network access to the leafnode port.
Potential Impact
The vulnerability allows remote unauthenticated attackers to cause a denial of service by crashing the nats-server via malformed messages sent to the leafnode port. This results in server unavailability to legitimate users. There is no impact on confidentiality or integrity. No known exploits in the wild have been reported.
Mitigation Recommendations
A fix is available in nats-server versions 2.11.15 and 2.12.6. Users should upgrade to these or later versions to remediate the vulnerability. If upgrading is not immediately possible, mitigating actions include disabling leafnode support if it is not required or restricting network access to the leafnode port to trusted sources. Red Hat notes that no mitigation fully meets their criteria for ease of use and stability, so upgrading is the recommended approach.
CVE-2026-33218: CWE-20: Improper Input Validation in nats-io nats-server
Description
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a client which can connect to the leafnode port can crash the nats-server with a certain malformed message pre-authentication. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, disable leafnode support if not needed or restrict network connections to the leafnode port, if plausible without compromising the service offered.
CVSS v3.1
Score 7.5high
Affected software
nats-io
nats-server
pkg:github/nats-io/nats-serverRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
NATS-Server, a high-performance messaging server for NATS.io, contains an improper input validation vulnerability (CWE-20, CWE-1286) in versions before 2.11.15 and 2.12.6. A remote attacker can connect to the leafnode port and send a malformed message pre-authentication that causes the server to crash, resulting in a denial of service (DoS). The vulnerability has a CVSS v3.1 score of 7.5 (high severity) with network attack vector, low complexity, no privileges or user interaction required, and impacts availability only. Red Hat advisory confirms the issue and notes that no easy mitigation meeting their criteria is available, recommending upgrading to fixed versions or applying workarounds such as disabling leafnode support or restricting network access to the leafnode port.
Potential Impact
The vulnerability allows remote unauthenticated attackers to cause a denial of service by crashing the nats-server via malformed messages sent to the leafnode port. This results in server unavailability to legitimate users. There is no impact on confidentiality or integrity. No known exploits in the wild have been reported.
Mitigation Recommendations
A fix is available in nats-server versions 2.11.15 and 2.12.6. Users should upgrade to these or later versions to remediate the vulnerability. If upgrading is not immediately possible, mitigating actions include disabling leafnode support if it is not required or restricting network access to the leafnode port to trusted sources. Red Hat notes that no mitigation fully meets their criteria for ease of use and stability, so upgrading is the recommended approach.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-03-17T23:23:58.314Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-33218","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:22347","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:21769","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:23345","vendor":"Red Hat"}]
Threat ID: 69c43f15f4197a8e3b7dafe4
Added to database: 03/25/2026, 20:01:25 UTC
Last enriched: 08/13/2026, 16:33:28 UTC
Last updated: 09/13/2026, 22:12:45 UTC
Views: 161
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.