Skip to content
OpenAdvisories
High · 7.7 CVE-2026-58207 EUVD-2026-42389

NATS Server: Remote crash via integer overflow in Connz pagination

Published Jul 8, 2026 · Updated Jul 9, 2026 · Assigned by GitHub_M

Vendor: nats-io Product: nats-server Package: nats-server Package: nats-server Package: telegraf Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, a client able to send account-scoped connection monitoring requests could crash the server by supplying Connz pagination Offset and Limit values that overflowed internal arithmetic before the response window was safely bounded. This issue is fixed in versions 2.14.3 and 2.12.12.

Affected products

VendorProductAffectedFixed
nats-io nats-server < 2.12.12, >= 2.14.0-RC.1, < 2.14.3 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 nats-server 2.14.3-1 —
Debian 13 nats-server No fix yet —
Debian 12 nats-server No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 nats-server No fix yet —
Ubuntu 25.10 nats-server No fix yet —
Ubuntu 24.04 LTS nats-server No fix yet —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 26.04 LTS nats-server No fix yet —

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 telegraf 1.31.0-27 —

Advisories 1

References