CVE-2026-58208

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-58208", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-29T17:09:25.872Z", "datePublished": "2026-07-08T20:17:39.187Z", "dateUpdated": "2026-07-09T14:04:28.045Z"}, "containers": {"cna": {"title": "NATS Server: MQTT-over-WebSocket Path Can Crash WebSocket-Only JetStream Servers Before MQTT Is Enabled", "problemTypes": [{"descriptions": [{"cweId": "CWE-248", "lang": "en", "description": "CWE-248: Uncaught Exception", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/nats-io/nats-server/security/advisories/GHSA-p957-7v2w-g93g", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nats-io/nats-server/security/advisories/GHSA-p957-7v2w-g93g"}, {"name": "https://github.com/nats-io/nats-server/commit/73b3dd9a5ea0fa7bf08b702338676355b29b5fb4", "tags": ["x_refsource_MISC"], "url": "https://github.com/nats-io/nats-server/commit/73b3dd9a5ea0fa7bf08b702338676355b29b5fb4"}, {"name": "https://github.com/nats-io/nats-server/commit/837536b98b3a9280b993282155ff2bdd3ca38c30", "tags": ["x_refsource_MISC"], "url": "https://github.com/nats-io/nats-server/commit/837536b98b3a9280b993282155ff2bdd3ca38c30"}, {"name": "https://github.com/nats-io/nats-server/releases/tag/v2.12.12", "tags": ["x_refsource_MISC"], "url": "https://github.com/nats-io/nats-server/releases/tag/v2.12.12"}, {"name": "https://github.com/nats-io/nats-server/releases/tag/v2.14.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/nats-io/nats-server/releases/tag/v2.14.3"}], "affected": [{"vendor": "nats-io", "product": "nats-server", "versions": [{"version": ">= 2.14.0-RC.1, < 2.14.3", "status": "affected"}, {"version": "< 2.12.12", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-08T20:17:39.187Z"}, "descriptions": [{"lang": "en", "value": "NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, a WebSocket listener could route requests for the MQTT-over-WebSocket path into MQTT handling even when MQTT was not configured, allowing an unauthenticated client with access to the WebSocket listener to reach uninitialized MQTT state and crash the server process. This issue is fixed in versions 2.14.3 and 2.12.12."}], "source": {"advisory": "GHSA-p957-7v2w-g93g", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-09T14:04:07.392572Z", "id": "CVE-2026-58208", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-09T14:04:28.045Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-58208", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-09T14:04:07.392572Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-09T14:04:13.535Z"}}], "cna": {"title": "NATS Server: MQTT-over-WebSocket Path Can Crash WebSocket-Only JetStream Servers Before MQTT Is Enabled", "source": {"advisory": "GHSA-p957-7v2w-g93g", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "nats-io", "product": "nats-server", "versions": [{"status": "affected", "version": ">= 2.14.0-RC.1, < 2.14.3"}, {"status": "affected", "version": "< 2.12.12"}]}], "references": [{"url": "https://github.com/nats-io/nats-server/security/advisories/GHSA-p957-7v2w-g93g", "name": "https://github.com/nats-io/nats-server/security/advisories/GHSA-p957-7v2w-g93g", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/nats-io/nats-server/commit/73b3dd9a5ea0fa7bf08b702338676355b29b5fb4", "name": "https://github.com/nats-io/nats-server/commit/73b3dd9a5ea0fa7bf08b702338676355b29b5fb4", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nats-io/nats-server/commit/837536b98b3a9280b993282155ff2bdd3ca38c30", "name": "https://github.com/nats-io/nats-server/commit/837536b98b3a9280b993282155ff2bdd3ca38c30", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nats-io/nats-server/releases/tag/v2.12.12", "name": "https://github.com/nats-io/nats-server/releases/tag/v2.12.12", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nats-io/nats-server/releases/tag/v2.14.3", "name": "https://github.com/nats-io/nats-server/releases/tag/v2.14.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, a WebSocket listener could route requests for the MQTT-over-WebSocket path into MQTT handling even when MQTT was not configured, allowing an unauthenticated client with access to the WebSocket listener to reach uninitialized MQTT state and crash the server process. This issue is fixed in versions 2.14.3 and 2.12.12."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-248", "description": "CWE-248: Uncaught Exception"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-08T20:17:39.187Z"}}}, "cveMetadata": {"cveId": "CVE-2026-58208", "state": "PUBLISHED", "dateUpdated": "2026-07-09T14:04:28.045Z", "dateReserved": "2026-06-29T17:09:25.872Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-08T20:17:39.187Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "nats-server", "vendor": "nats-io", "versions": [{"status": "affected", "version": ">= 2.14.0-RC.1, < 2.14.3"}, {"status": "affected", "version": "< 2.12.12"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:*", "matchCriteriaId": "410EBCA5-133B-48F5-BF7D-53F8BC020506", "versionEndExcluding": "2.12.12", "versionStartIncluding": "2.12.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:*", "matchCriteriaId": "9BF70729-64AF-4219-BC35-3C5C042F0595", "versionEndExcluding": "2.14.3", "versionStartIncluding": "2.14.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, a WebSocket listener could route requests for the MQTT-over-WebSocket path into MQTT handling even when MQTT was not configured, allowing an unauthenticated client with access to the WebSocket listener to reach uninitialized MQTT state and crash the server process. This issue is fixed in versions 2.14.3 and 2.12.12."}, {"lang": "es", "value": "NATS Server es un servidor de alto rendimiento para NATS.io, el sistema de mensajer\u00eda nativo de la nube y del borde. Antes de las versiones 2.14.3 y 2.12.12, un oyente de WebSocket pod\u00eda enrutar solicitudes para la ruta MQTT-over-WebSocket hacia el manejo de MQTT incluso cuando MQTT no estaba configurado, permitiendo a un cliente no autenticado con acceso al oyente de WebSocket alcanzar un estado MQTT no inicializado y colapsar el proceso del servidor. Este problema est\u00e1 solucionado en las versiones 2.14.3 y 2.12.12."}], "id": "CVE-2026-58208", "lastModified": "2026-10-25T17:10:00.197", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-58208", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-09T14:04:07.392572Z", "version": "2.0.3"}}]}, "published": "2026-07-08T21:16:52.440", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/nats-io/nats-server/commit/73b3dd9a5ea0fa7bf08b702338676355b29b5fb4"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/nats-io/nats-server/commit/837536b98b3a9280b993282155ff2bdd3ca38c30"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/nats-io/nats-server/releases/tag/v2.12.12"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/nats-io/nats-server/releases/tag/v2.14.3"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/nats-io/nats-server/security/advisories/GHSA-p957-7v2w-g93g"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-248"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/nats-io/nats-server: NATS Server: Denial of Service due to incorrect MQTT-over-WebSocket request routing", "id": "2498254", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498254"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-824", "details": ["NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, a WebSocket listener could route requests for the MQTT-over-WebSocket path into MQTT handling even when MQTT was not configured, allowing an unauthenticated client with access to the WebSocket listener to reach uninitialized MQTT state and crash the server process. This issue is fixed in versions 2.14.3 and 2.12.12.", "A flaw was found in NATS Server. An unauthenticated client with access to the WebSocket listener could exploit a vulnerability where requests for the MQTT-over-WebSocket path were incorrectly routed into MQTT handling, even when MQTT was not configured. This allowed the client to access uninitialized MQTT state, leading to a server process crash. This can result in a Denial of Service (DoS) for the NATS Server."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, restrict network access to the NATS Server's WebSocket listener to trusted clients only using firewall rules. If the WebSocket listener is not required, it can be disabled in the NATS Server configuration. Disabling the WebSocket listener may impact services that rely on WebSocket connectivity to the NATS Server. After making configuration changes, ensure to restart the NATS Server process for the changes to take effect."}, "name": "CVE-2026-58208", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "nats-server2.12", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "nats-server2.14", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-07-08T20:17:39Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-58208\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-58208\nhttps://github.com/nats-io/nats-server/commit/73b3dd9a5ea0fa7bf08b702338676355b29b5fb4\nhttps://github.com/nats-io/nats-server/commit/837536b98b3a9280b993282155ff2bdd3ca38c30\nhttps://github.com/nats-io/nats-server/releases/tag/v2.12.12\nhttps://github.com/nats-io/nats-server/releases/tag/v2.14.3\nhttps://github.com/nats-io/nats-server/security/advisories/GHSA-p957-7v2w-g93g"], "statement": "This Moderate flaw in NATS Server allows an unauthenticated remote attacker to cause a denial of service. The vulnerability arises from incorrect routing of WebSocket requests to uninitialized MQTT handling, even when MQTT is not configured, leading to a server crash. This impacts the availability of NATS Server deployments that expose a WebSocket listener, as it does not require specific MQTT configuration to exploit.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.14.0-RC.1,2.14.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.12.12)"}}], "enrichment": {"confidence": 91.0, "confidence_source": "matching", "scores": [{"score": 91.0, "source": "matching"}]}, "original": {"product": "nats-server", "source": "cna", "vendor": "nats-io"}, "product": "nats_server", "vendor": "nats"}], "created": "2026-07-09T04:15:12.525976+00:00", "updated": "2026-08-01T15:45:04.321403+00:00", "vendors": ["nats", "nats$PRODUCT$nats_server"]}