7.7Hoch
CVE-2026-58207NATS Server: Remote crash via integer overflow in Connz pagination
Beschreibung
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, a client able to send account-scoped connection monitoring requests could crash the server by supplying Connz pagination Offset and Limit values that overflowed internal arithmetic before the response window was safely bounded. This issue is fixed in versions 2.14.3 and 2.12.12.
Schwachstellentyp (CWE):
CWE-190
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| linuxfoundation | nats-server | 2.12.0 – < 2.12.12 | |
| nats-io | nats-server | < 2.12.12, >= 2.14.0-RC.1, < 2.14.3 |
Referenzen und Patches
- https://github.com/nats-io/nats-server/security/advisories/GHSA-q59r-vq66-pxc2 MitigationVendor Advisory
- https://github.com/nats-io/nats-server/commit/2ae047139e37a38cb01e259a67909e7a39fa38e9 Patch
- https://github.com/nats-io/nats-server/commit/894d9411927681d66ce349bf1afe49608dc0c1a3 Patch
- https://github.com/nats-io/nats-server/releases/tag/v2.12.12 Release Notes
- https://github.com/nats-io/nats-server/releases/tag/v2.14.3 Release Notes
CPE-Treffer (NVD) (2)
cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:*≥ 2.12.0 < 2.12.12cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:*≥ 2.14.0 < 2.14.3