NATS Server Connection Monitoring Request Overflow

Publication date: 2026-07-08

Last updated on: 2026-07-08

Assigner: GitHub, Inc.

Description

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, a client able to send account-scoped connection monitoring requests could crash the server by supplying Connz pagination Offset and Limit values that overflowed internal arithmetic before the response window was safely bounded. This issue is fixed in versions 2.14.3 and 2.12.12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-08

Last Modified

2026-07-08

Generated

2026-07-09

AI Q&A

2026-07-09

EPSS Evaluated

N/A

NVD

CVE-2026-58207

Affected Vendors & Products

Vendor	Product	Version / Range
nats_io	nats_server	to 2.12.12 (inc)
nats_io	nats_server	to 2.14.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

Executive Summary

This vulnerability affects the NATS Server, a high-performance messaging server. Before versions 2.14.3 and 2.12.12, a client that could send account-scoped connection monitoring requests was able to crash the server. This was done by supplying Connz pagination Offset and Limit values that caused an overflow in internal arithmetic before the response window was safely bounded.

Impact Analysis

The vulnerability can cause a denial of service by crashing the NATS Server. This means that an attacker with the ability to send specific monitoring requests could disrupt the availability of the messaging system, potentially impacting applications and services that rely on it.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade your NATS Server to version 2.14.3 or 2.12.12 or later, where the issue has been fixed.

Hi! I’m here to help you understand CVE-2026-58207. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70