Junglewise Threat Intelligence

CVE-2026-58207: NATS Server integer overflow in Connz pagination monitoring requests

CVE-2026-58207 · Severity: high · CVSS 7.7 · Published 2026-07-08

Technologies: Nats-Io NATS Server.

Executive brief

NATS Server is a high-performance messaging system used for cloud and edge computing. A vulnerability in how the server handles monitoring requests allows a connected user to crash the server by sending specially crafted messages. This results in a denial-of-service, disrupting communication across the entire messaging network.

Technical details

An integer overflow vulnerability (CWE-190) exists in the NATS Server monitoring endpoints (Connz and Subsz). The flaw is located in the pagination logic where 'Offset' and 'Limit' values are processed; specifically, these values can overflow internal arithmetic before the response window is safely bounded. An attacker with the ability to send account-scoped connection monitoring requests can exploit this to trigger a panic and crash the server. In no-auth deployments, any client with network access can trigger the crash, while in multi-tenant environments, the attacker must have permissions to publish to the account monitoring request subject. The issue is resolved in versions 2.14.3 and 2.12.12.

Affected products

  • nats-io nats-server < 2.12.12, >= 2.14.0-RC.1, < 2.14.3

Timeline

  • 2026-06-29: patched: Versions 2.14.3 and 2.12.12 released
  • 2026-06-29: advisory: GitHub Security Advisory GHSA-q59r-vq66-pxc2 published
  • 2026-07-08: disclosed: CVE-2026-58207 published to NVD

References