CVE-2026-58210

HIGH7.5

NATS Server: MQTT partial CONNECT packets can exhaust pre-auth memory

Published Jul 8, 2026

Modified 3 months ago

Fix available

Details

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, an unauthenticated MQTT client could cause the server to retain large incomplete MQTT CONNECT packets before authentication completed, consuming server memory while the parser waited for the advertised MQTT packet length. This issue is fixed in versions 2.14.3 and 2.12.12.

Affected Packages

NATS Server for Paessler PRTG

Windows 10 (1507)Windows 10 (1607) / Server 2016Windows 10 (1703)Windows 10 (1709)Windows 10 (1803)

Fixed in:

2.12.122.14.3

References

WEB

https://github.com/nats-io/nats-server/commit/bce9ef39469e610aeddb819194ceb7f7edfc0861

WEB

https://github.com/nats-io/nats-server/commit/e016e47bbf70304945f2ae9dc397e4862adefaf5

WEB

https://github.com/nats-io/nats-server/releases/tag/v2.12.12