Junglewise Threat Intelligence

CVE-2026-58210: NATS Server denial of service via MQTT memory exhaustion

CVE-2026-58210 · Severity: high · CVSS 7.5 · Published 2026-07-08

Technologies: Nats-Io NATS Server.

Executive brief

NATS Server is a high-performance messaging system used for cloud and edge computing. A vulnerability in its MQTT handling allows unauthenticated attackers to crash or slow down the server by sending large, incomplete connection requests. This can lead to a denial-of-service, disrupting communications for all connected applications and services.

Technical details

NATS Server prior to versions 2.14.3 and 2.12.12 contains a resource consumption vulnerability (CWE-400) in its MQTT parser. An unauthenticated remote attacker can send an MQTT CONNECT packet with a large advertised length but only transmit a portion of the data. The server buffers these incomplete packets in memory while waiting for the remaining data or an authentication timeout, leading to memory exhaustion. The fix introduces a check to reject MQTT packets that exceed the client's maximum payload limit before buffering occurs.

Affected products

  • nats-io nats-server < 2.12.12, >= 2.14.0-RC.1, < 2.14.3

Timeline

  • 2026-06-12: other: Vulnerability fixed in source code
  • 2026-06-29: patched: Version 2.12.12 released
  • 2026-07-08: disclosed: CVE-2026-58210 published

References