CVE-2026-58210

Katalog CVE

CVSS 7.5 · High EPSS 0,74%

Kerentanan Uncontrolled Resource Consumption pada linuxfoundation nats-server. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, an unauthenticated MQTT client could cause the server to retain large incomplete MQTT CONNECT packets before authentication completed, consuming server memory while the parser waited for the advertised MQTT packet length. This issue is fixed in versions 2.14.3 and 2.12.12.

Rincian

Terbit di NVD

8 Juli 2026

Terakhir diubah

13 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption

EPSS (30 hari)

0,74% peluang dieksploitasi; lebih tinggi dari 53,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nats-io/nats-server/security/advisories/GHSA-r72h-j7qq-v6qg advisory vendor
• https://github.com/nats-io/nats-server/commit/bce9ef39469e610aeddb819194ceb7f7edfc0861 patch
• https://github.com/nats-io/nats-server/commit/e016e47bbf70304945f2ae9dc397e4862adefaf5 patch
• https://github.com/nats-io/nats-server/releases/tag/v2.12.12 release notes
• https://github.com/nats-io/nats-server/releases/tag/v2.14.3 release notes