CVE-2026-58250

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-58250", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-29T21:54:30.330Z", "datePublished": "2026-07-08T19:48:55.058Z", "dateUpdated": "2026-07-09T13:33:45.059Z"}, "containers": {"cna": {"title": "NATS Server: Pre-auth server crash via double INFO in leafnode handshake", "problemTypes": [{"descriptions": [{"cweId": "CWE-476", "lang": "en", "description": "CWE-476: NULL Pointer Dereference", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/nats-io/nats-server/security/advisories/GHSA-3g5q-cfh2-cq67", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nats-io/nats-server/security/advisories/GHSA-3g5q-cfh2-cq67"}, {"name": "https://github.com/nats-io/nats-server/commit/8dcb26eaea78fdcbe96dbee5986d6019fd5cb94a", "tags": ["x_refsource_MISC"], "url": "https://github.com/nats-io/nats-server/commit/8dcb26eaea78fdcbe96dbee5986d6019fd5cb94a"}, {"name": "https://github.com/nats-io/nats-server/commit/fc5fe39177533e9dbdd651d2458285bfae1dde27", "tags": ["x_refsource_MISC"], "url": "https://github.com/nats-io/nats-server/commit/fc5fe39177533e9dbdd651d2458285bfae1dde27"}, {"name": "https://github.com/nats-io/nats-server/releases/tag/v2.11.17", "tags": ["x_refsource_MISC"], "url": "https://github.com/nats-io/nats-server/releases/tag/v2.11.17"}, {"name": "https://github.com/nats-io/nats-server/releases/tag/v2.12.8", "tags": ["x_refsource_MISC"], "url": "https://github.com/nats-io/nats-server/releases/tag/v2.12.8"}], "affected": [{"vendor": "nats-io", "product": "nats-server", "versions": [{"version": "< 2.11.17", "status": "affected"}, {"version": ">= 2.12.0-preview.1, < 2.12.8", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-08T19:48:55.058Z"}, "descriptions": [{"lang": "en", "value": "NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.12.8 and 2.11.17, an unauthenticated peer with network access to a leafnode listener with compression enabled could crash the server during the pre-authentication leafnode handshake by sending repeated leafnode INFO protocol messages before authentication and account setup completed. This issue is fixed in versions 2.12.8 and 2.11.17."}], "source": {"advisory": "GHSA-3g5q-cfh2-cq67", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-09T13:33:35.375405Z", "id": "CVE-2026-58250", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-09T13:33:45.059Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-58250", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-09T13:33:35.375405Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-09T13:33:39.593Z"}}], "cna": {"title": "NATS Server: Pre-auth server crash via double INFO in leafnode handshake", "source": {"advisory": "GHSA-3g5q-cfh2-cq67", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "nats-io", "product": "nats-server", "versions": [{"status": "affected", "version": "< 2.11.17"}, {"status": "affected", "version": ">= 2.12.0-preview.1, < 2.12.8"}]}], "references": [{"url": "https://github.com/nats-io/nats-server/security/advisories/GHSA-3g5q-cfh2-cq67", "name": "https://github.com/nats-io/nats-server/security/advisories/GHSA-3g5q-cfh2-cq67", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/nats-io/nats-server/commit/8dcb26eaea78fdcbe96dbee5986d6019fd5cb94a", "name": "https://github.com/nats-io/nats-server/commit/8dcb26eaea78fdcbe96dbee5986d6019fd5cb94a", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nats-io/nats-server/commit/fc5fe39177533e9dbdd651d2458285bfae1dde27", "name": "https://github.com/nats-io/nats-server/commit/fc5fe39177533e9dbdd651d2458285bfae1dde27", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nats-io/nats-server/releases/tag/v2.11.17", "name": "https://github.com/nats-io/nats-server/releases/tag/v2.11.17", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nats-io/nats-server/releases/tag/v2.12.8", "name": "https://github.com/nats-io/nats-server/releases/tag/v2.12.8", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.12.8 and 2.11.17, an unauthenticated peer with network access to a leafnode listener with compression enabled could crash the server during the pre-authentication leafnode handshake by sending repeated leafnode INFO protocol messages before authentication and account setup completed. This issue is fixed in versions 2.12.8 and 2.11.17."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-476", "description": "CWE-476: NULL Pointer Dereference"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-08T19:48:55.058Z"}}}, "cveMetadata": {"cveId": "CVE-2026-58250", "state": "PUBLISHED", "dateUpdated": "2026-07-09T13:33:45.059Z", "dateReserved": "2026-06-29T21:54:30.330Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-08T19:48:55.058Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "nats-server", "vendor": "nats-io", "versions": [{"status": "affected", "version": "< 2.11.17"}, {"status": "affected", "version": ">= 2.12.0-preview.1, < 2.12.8"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:*", "matchCriteriaId": "31B216FA-8691-4074-84FC-947A8B616031", "versionEndExcluding": "2.11.17", "vulnerable": true}, {"criteria": "cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:*", "matchCriteriaId": "540D8F95-FC42-4FCA-B219-754895555F2A", "versionEndExcluding": "2.12.8", "versionStartIncluding": "2.12.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.12.8 and 2.11.17, an unauthenticated peer with network access to a leafnode listener with compression enabled could crash the server during the pre-authentication leafnode handshake by sending repeated leafnode INFO protocol messages before authentication and account setup completed. This issue is fixed in versions 2.12.8 and 2.11.17."}, {"lang": "es", "value": "NATS Server es un servidor de alto rendimiento para NATS.io, el sistema de mensajer\u00eda nativo de la nube y del borde. Antes de las versiones 2.12.8 y 2.11.17, un par no autenticado con acceso de red a un oyente de nodo hoja con compresi\u00f3n habilitada podr\u00eda bloquear el servidor durante el handshake de nodo hoja previo a la autenticaci\u00f3n al enviar mensajes de protocolo INFO de nodo hoja repetidos antes de que la autenticaci\u00f3n y la configuraci\u00f3n de la cuenta se completaran. Este problema est\u00e1 solucionado en las versiones 2.12.8 y 2.11.17."}], "id": "CVE-2026-58250", "lastModified": "2026-10-25T17:10:00.197", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-58250", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-09T13:33:35.375405Z", "version": "2.0.3"}}]}, "published": "2026-07-08T20:16:54.483", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/nats-io/nats-server/commit/8dcb26eaea78fdcbe96dbee5986d6019fd5cb94a"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/nats-io/nats-server/commit/fc5fe39177533e9dbdd651d2458285bfae1dde27"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/nats-io/nats-server/releases/tag/v2.11.17"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/nats-io/nats-server/releases/tag/v2.12.8"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/nats-io/nats-server/security/advisories/GHSA-3g5q-cfh2-cq67"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/nats-io/nats-server: NATS Server: Denial of Service via repeated leafnode INFO messages during pre-authentication", "id": "2498257", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498257"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.12.8 and 2.11.17, an unauthenticated peer with network access to a leafnode listener with compression enabled could crash the server during the pre-authentication leafnode handshake by sending repeated leafnode INFO protocol messages before authentication and account setup completed. This issue is fixed in versions 2.12.8 and 2.11.17.", "A flaw was found in NATS Server, a high-performance messaging system. An unauthenticated attacker with network access to a leafnode listener, where compression is enabled, could exploit this vulnerability. By sending repeated leafnode INFO protocol messages during the pre-authentication handshake, the attacker can cause the server to crash. This leads to a Denial of Service (DoS), making the server unavailable to legitimate users."], "mitigation": {"lang": "en:us", "value": "To reduce exposure, disable compression on NATS Server leafnode listeners if not strictly required for your environment. Alternatively, implement network access controls to restrict connectivity to leafnode listeners to only trusted clients. This limits the ability of unauthenticated peers to initiate the vulnerable handshake."}, "name": "CVE-2026-58250", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "nats-server2.12", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "nats-server2.14", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-07-08T19:48:55Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-58250\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-58250\nhttps://github.com/nats-io/nats-server/commit/8dcb26eaea78fdcbe96dbee5986d6019fd5cb94a\nhttps://github.com/nats-io/nats-server/commit/fc5fe39177533e9dbdd651d2458285bfae1dde27\nhttps://github.com/nats-io/nats-server/releases/tag/v2.11.17\nhttps://github.com/nats-io/nats-server/releases/tag/v2.12.8\nhttps://github.com/nats-io/nats-server/security/advisories/GHSA-3g5q-cfh2-cq67"], "statement": "This is an Important denial of service vulnerability in NATS Server. An unauthenticated remote attacker with network access to a leafnode listener, configured with compression enabled, could repeatedly send INFO protocol messages during the pre-authentication handshake. This action would cause the NATS server to crash, leading to a denial of service for legitimate users.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.11.17)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.12.0-preview.1,2.12.8)"}}], "enrichment": {"confidence": 91.0, "confidence_source": "matching", "scores": [{"score": 91.0, "source": "matching"}]}, "original": {"product": "nats-server", "source": "cna", "vendor": "nats-io"}, "product": "nats_server", "vendor": "nats"}], "created": "2026-07-09T15:45:06.154544+00:00", "updated": "2026-08-01T15:45:04.328394+00:00", "vendors": ["nats", "nats$PRODUCT$nats_server"]}