Resource exhaustion in Nats-io Nats-server
CVE-2026-58210
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, an unauthenticated MQTT client could cause the server to retain large incomplete MQTT CONNECT packets before aut…
Vulnerability class: DoS (Denial of Service)
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Nats-io Nats-server — versions < 2.12.12, >= 2.14.0-RC.1, < 2.14.3
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_CONFIRM)
Frequently asked questions
- What is CVE-2026-58210?
- CVE-2026-58210 is a high-severity vulnerability in Nats-io Nats-server, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2026-07-08.
- How severe is CVE-2026-58210?
- High severity. CVSS v3 base score is 7.5 out of 10.