Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-08T20:15:31 github.com/nats-io/nats-server: NATS Server: Denial of Service via arithmetic overflow in connection monitoring pagination 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CWE-190

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, a client able to send account-scoped connection monitoring requests could crash the server by supplying Connz pagination Offset and Limit values that overflowed internal arithmetic before the response window was safely bounded. This issue is fixed in versions 2.14.3 and 2.12.12.

A flaw was found in NATS Server. A client with the ability to send account-scoped connection monitoring requests could crash the server. This is achieved by providing pagination offset and limit values that cause an arithmetic overflow, leading to a Denial of Service (DoS).

CVE.org and NVD independently assess this issue at different severities than Red Hat because CVE.org uses a Changed scope (S:C) in its CVSS vector, treating the crash as impacting components beyond the NATS Server process itself. Red Hat, consistent with NVDs own scoring, assesses the impact as scoped to the NATS Server process (Scope Unchanged), resulting in a CVSS score of 6.5 and a Moderate impact rating. Only account-scoped connection-monitoring requests can trigger the arithmetic overflow, and no Red Hat product runs an externally-reachable, unauthenticated NATS Server monitoring endpoint by default. Upstream mitigation: restrict publish access to system request subjects (e.g. \.REQ.ACCOUNT.*.CONNZ) for untrusted clients, and avoid no-auth NATS deployments where untrusted clients can publish to system monitoring request subjects. Upgrading to nats-server 2.14.3 or 2.12.12 (or later) fully resolves the issue. Multicluster Global Hub Fix deferred multicluster-globalhub/multicluster-globalhub-grafana-rhel9 Red Hat Ceph Storage 5 Fix deferred rhceph/snmp-notifier-rhel8 Red Hat Ceph Storage 6 Fix deferred rhceph/snmp-notifier-rhel9 Red Hat Ceph Storage 7 Fix deferred rhceph/snmp-notifier-rhel9 Red Hat Ceph Storage 8 Fix deferred rhceph/snmp-notifier-rhel9 Red Hat Ceph Storage 9 Fix deferred rhceph/snmp-notifier-rhel10 Red Hat Hardened Images Not affected nats-server2.12 Red Hat Hardened Images Not affected nats-server2.14 Red Hat OpenShift Container Platform 4 Not affected openshift4/oc-mirror-plugin-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-58207 https://nvd.nist.gov/vuln/detail/CVE-2026-58207 https://github.com/nats-io/nats-server/commit/2ae047139e37a38cb01e259a67909e7a39fa38e9 https://github.com/nats-io/nats-server/commit/894d9411927681d66ce349bf1afe49608dc0c1a3 https://github.com/nats-io/nats-server/releases/tag/v2.12.12 https://github.com/nats-io/nats-server/releases/tag/v2.14.3 https://github.com/nats-io/nats-server/security/advisories/GHSA-q59r-vq66-pxc2