CVE-2026-58207

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, a client able to send account-scoped connection monitoring requests could crash the server by supplying Connz pagination Offset and Limit values that overflowed internal arithmetic before the response window was safely bounded. This issue is fixed in versions 2.14.3 and 2.12.12.

CVSS v3 7.7 HIGH

7.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.1 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/nats-io/nats-server/commit/2ae047139e37a38cb01e259a67909e7a39fa38e9	Patch
https://github.com/nats-io/nats-server/commit/894d9411927681d66ce349bf1afe49608dc0c1a3	Patch
https://github.com/nats-io/nats-server/releases/tag/v2.12.12	Release Notes
https://github.com/nats-io/nats-server/releases/tag/v2.14.3	Release Notes
https://github.com/nats-io/nats-server/security/advisories/GHSA-q59r-vq66-pxc2	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:linuxfoundation:nats-server::::::::
	cpe:2.3:a:linuxfoundation:nats-server::::::::

History

25 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) NATS Server es un servidor de alto rendimiento para NATS.io, el sistema de mensajería nativo de la nube y del borde. Antes de las versiones 2.14.3 y 2.12.12, un cliente capaz de enviar solicitudes de monitoreo de conexión con ámbito de cuenta podría bloquear el servidor al proporcionar valores de Offset y Limit de paginación de Connz que desbordaban la aritmética interna antes de que la ventana de respuesta estuviera acotada de forma segura. Este problema está solucionado en las versiones 2.14.3 y 2.12.12.

Information

Published : 2026-07-08 21:16

Updated : 2026-10-25 17:10

NVD link : CVE-2026-58207

Mitre link : CVE-2026-58207

CVE.ORG link : CVE-2026-58207

JSON object : View

Products Affected

linuxfoundation

nats-server

CWE

CWE-190

Integer Overflow or Wraparound

{"id": "CVE-2026-58207", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-58207", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-09T14:21:06.599044Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 3.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "nats-io", "product": "nats-server", "versions": [{"status": "affected", "version": "< 2.12.12"}, {"status": "affected", "version": ">= 2.14.0-RC.1, < 2.14.3"}]}]}], "published": "2026-07-08T21:16:52.293", "references": [{"url": "https://github.com/nats-io/nats-server/commit/2ae047139e37a38cb01e259a67909e7a39fa38e9", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nats-io/nats-server/commit/894d9411927681d66ce349bf1afe49608dc0c1a3", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nats-io/nats-server/releases/tag/v2.12.12", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nats-io/nats-server/releases/tag/v2.14.3", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nats-io/nats-server/security/advisories/GHSA-q59r-vq66-pxc2", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, a client able to send account-scoped connection monitoring requests could crash the server by supplying Connz pagination Offset and Limit values that overflowed internal arithmetic before the response window was safely bounded. This issue is fixed in versions 2.14.3 and 2.12.12."}, {"lang": "es", "value": "NATS Server es un servidor de alto rendimiento para NATS.io, el sistema de mensajer\u00eda nativo de la nube y del borde. Antes de las versiones 2.14.3 y 2.12.12, un cliente capaz de enviar solicitudes de monitoreo de conexi\u00f3n con \u00e1mbito de cuenta podr\u00eda bloquear el servidor al proporcionar valores de Offset y Limit de paginaci\u00f3n de Connz que desbordaban la aritm\u00e9tica interna antes de que la ventana de respuesta estuviera acotada de forma segura. Este problema est\u00e1 solucionado en las versiones 2.14.3 y 2.12.12."}], "lastModified": "2026-10-25T17:10:00.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "410EBCA5-133B-48F5-BF7D-53F8BC020506", "versionEndExcluding": "2.12.12", "versionStartIncluding": "2.12.0"}, {"criteria": "cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9BF70729-64AF-4219-BC35-3C5C042F0595", "versionEndExcluding": "2.14.3", "versionStartIncluding": "2.14.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}