Junglewise Threat Intelligence

CVE-2026-33218: NATS-Server denial of service in leafnode handling

CVE-2026-33218 · Severity: high · CVSS 7.5 · Published 2026-03-25

Technologies: github.com/nats-io/nats-server/v2 (Go), Nats-Io NATS Server, github.com/nats-io/nats-server (Go), Red Hat Multicluster Global Hub. Vendors: Red Hat, Go.

Executive brief

NATS-Server is a high-performance messaging system used for cloud and edge computing to facilitate communication between different applications. A vulnerability exists where an unauthenticated attacker can send a specially crafted message to the server's leafnode port, causing the service to crash. This results in a denial-of-service (DoS) condition, disrupting communication across the network and potentially halting business operations that rely on the messaging system.

Technical details

A denial-of-service vulnerability exists in NATS-Server due to improper input validation (CWE-20) or improper validation of syntactic correctness (CWE-1286) within the leafnode handling component. An unauthenticated remote attacker with network access to the leafnode port can trigger a server panic by sending a malformed message. This exploit occurs pre-authentication, meaning no valid credentials are required to crash the service. The vulnerability affects all versions prior to 2.11.15 and 2.12.6. Patches are available in versions 2.11.15 and 2.12.6; workarounds include disabling leafnode support or implementing network-level access controls on the leafnode port.

Affected products

  • nats-io nats-server < 2.11.15, >= 2.12.0-RC.1 < 2.12.6
  • Red Hat Multicluster Global Hub 1.4.5
  • Red Hat Multicluster Global Hub 1.5.4
  • Red Hat Multicluster Global Hub 1.6.2

Timeline

  • 2026-03-24: advisory: NATS project released security advisory 2026-10
  • 2026-03-25: disclosed: CVE-2026-33218 published
  • 2026-05-28: patched: Red Hat released security update RHSA-2026:21769 for Multicluster Global Hub

References

Related threats