The vulnerability CVE-2026-33219 affects nats-io nats-server versions prior to 2.11.15 and 2.12.6. It involves allocation of resources without limits or throttling (CWE-770), where a malicious client connected to the WebSockets port can cause unbounded memory use before authentication by sending a large volume of data. Unlike the related CVE-2026-27571 compression bomb vulnerability, this issue does not rely on compression but still requires significant bandwidth from the attacker. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts availability only. Fixed versions 2.11.15 and 2.12.6 contain the official fix. The vendor advisory from Red Hat confirms the fix and recommends disabling WebSockets if not required.

Successful exploitation allows a remote unauthenticated attacker to cause unbounded memory consumption on the nats-server via the WebSockets port, potentially leading to denial of service due to resource exhaustion. There is no impact on confidentiality or integrity. The attack requires significant client bandwidth and connection to the WebSockets port.

An official fix is available in nats-server versions 2.11.15 and 2.12.6. Users should upgrade to these or later versions to remediate the vulnerability. As a workaround, disabling the WebSockets feature if it is not required for the deployment can mitigate the risk. No other specific mitigations are indicated by the vendor advisory.