{"id":"CVE-2026-33218","state":"PUBLISHED","title":"NATS has pre-auth server panic via leafnode handling","description":"NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a client which can connect to the leafnode port can crash the nats-server with a certain malformed message pre-authentication. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, disable leafnode support if not needed or restrict network connections to the leafnode port, if plausible without compromising the service offered.","publishedAt":"2026-03-25T19:53:12.075Z","updatedAt":"2026-09-09T12:05:08.560Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"GitHub_M"},"assigner":"GitHub_M","products":["nats-io nats-server"],"affected":[{"vendor":"nats-io","product":"nats-server","versions":[{"version":"< < 2.11.15","status":"affected"},{"version":">= 2.12.0-RC.1, < 2.12.6","status":"affected"}]}],"references":["https://github.com/nats-io/nats-server/security/advisories/GHSA-vprv-35vv-q339","https://advisories.nats.io/CVE/secnote-2026-10.txt","https://access.redhat.com/security/cve/CVE-2026-33218","https://bugzilla.redhat.com/show_bug.cgi?id=2451450","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33218.json","https://access.redhat.com/errata/RHSA-2026:22347","https://access.redhat.com/errata/RHSA-2026:23345","https://access.redhat.com/errata/RHSA-2026:21769"],"weaknesses":["CWE-20","CWE-1286"],"ingestedAt":"2026-10-29T20:11:40.391Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/33xxx/CVE-2026-33218.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-33218","state":"PUBLISHED","datePublished":"2026-03-25T19:53:12.075Z","dateUpdated":"2026-09-09T12:05:08.560Z","assignerShortName":"GitHub_M","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateReserved":"2026-03-17T23:23:58.314Z"},"containers":{"cna":{"title":"NATS has pre-auth server panic via leafnode handling","descriptions":[{"lang":"en","value":"NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a client which can connect to the leafnode port can crash the nats-server with a certain malformed message pre-authentication. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, disable leafnode support if not needed or restrict network connections to the leafnode port, if plausible without compromising the service offered."}],"affected":[{"vendor":"nats-io","product":"nats-server","versions":[{"version":"< < 2.11.15","status":"affected"},{"version":">= 2.12.0-RC.1, < 2.12.6","status":"affected"}]}],"references":[{"url":"https://github.com/nats-io/nats-server/security/advisories/GHSA-vprv-35vv-q339","name":"https://github.com/nats-io/nats-server/security/advisories/GHSA-vprv-35vv-q339","tags":["x_refsource_CONFIRM"]},{"url":"https://advisories.nats.io/CVE/secnote-2026-10.txt","name":"https://advisories.nats.io/CVE/secnote-2026-10.txt","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-20","lang":"en","description":"CWE-20: Improper Input Validation","type":"CWE"}]}],"providerMetadata":{"shortName":"GitHub_M","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateUpdated":"2026-03-25T19:53:12.075Z"},"source":{"advisory":"GHSA-vprv-35vv-q339","discovery":"UNKNOWN"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-03-26T15:37:53.583818Z","id":"CVE-2026-33218","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-03-26T15:37:59.614Z"}},{"title":"nats-server: github.com/nats-io/nats-server: NATS-Server: Denial of Service via malformed message pre-authentication on leafnode port","descriptions":[{"lang":"en","value":"A flaw was found in NATS-Server, a high-performance messaging system. A remote attacker, by connecting to the leafnode port and sending a specially crafted malformed message before authentication, can cause the nats-server to crash. This vulnerability leads to a Denial of Service (DoS), making the server unavailable to legitimate users."}],"affected":[{"vendor":"Red Hat","product":"Multicluster Global Hub 1.4.5","packageName":"multicluster-globalhub/multicluster-globalhub-grafana-rhel9","defaultStatus":"affected","versions":[{"version":"1779579439","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:multicluster_globalhub:1.4::el9"]},{"vendor":"Red Hat","product":"Multicluster Global Hub 1.6.5","packageName":"multicluster-globalhub/multicluster-globalhub-grafana-rhel9","defaultStatus":"affected","versions":[{"version":"1780167118","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:multicluster_globalhub:1.6::el9"]},{"vendor":"Red Hat","product":"Red Hat multicluster global hub 1.5.3","packageName":"multicluster-globalhub/multicluster-globalhub-grafana-rhel9","defaultStatus":"affected","versions":[{"version":"1778867753","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:multicluster_globalhub:1.5::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/oc-mirror-plugin-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-33218","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451450","name":"RHBZ#2451450","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33218.json","tags":["x_sadp-csaf-vex"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22347","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:23345","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:21769","tags":["vendor-advisory","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Important"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-1286","description":"Improper Validation of Syntactic Correctness of Input","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat-SADP","orgId":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","dateUpdated":"2026-09-09T12:05:08.560Z"},"datePublic":"2026-03-25T19:53:12.075Z","solutions":[{"lang":"en","value":"RHSA-2026:22347: Multicluster Global Hub 1.4.5"},{"lang":"en","value":"RHSA-2026:23345: Multicluster Global Hub 1.6.5"},{"lang":"en","value":"RHSA-2026:21769: Red Hat multicluster global hub 1.5.3"}],"timeline":[{"lang":"en","time":"2026-03-25T20:02:13.680Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-03-25T19:53:12.075Z","value":"Made public."}],"workarounds":[{"lang":"en","value":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}],"x_adpType":"supplier","x_generator":{"engine":"sadp-cli 1.0.0"}}]}}}