CVE-2026-33218
EUVD-2026-1596825.03.2026, 20:16
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a client which can connect to the leafnode port can crash the nats-server with a certain malformed message pre-authentication. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, disable leafnode support if not needed or restrict network connections to the leafnode port, if plausible without compromising the service offered.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| linuxfoundation | nats-server | 𝑥 < 2.11.15 |
| linuxfoundation | nats-server | 2.12.0 ≤ 𝑥 < 2.12.6 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| Red Hat | Multicluster Global Hub 1.4.5 | 1779579439 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat multicluster global hub 1.5.0 | 1778867753 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat multicluster global hub 1.6.0 | 1780167118 ≤ 𝑥 < * | ADP |
Debian Releases
Ubuntu Releases
Common Weakness Enumeration
- CWE-20 - Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-1286 - Improper Validation of Syntactic Correctness of InputThe product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax.
References