What is the CVSS score of CVE-2026-58207?

CVE-2026-58207 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.5%.

How to fix or mitigate CVE-2026-58207?

Within 24 hours: Identify all NATS Server deployments and document their versions using 'nats-server -v'; assess which networks and clients can reach the /connz and /subsz HTTP monitoring endpoints. Within 7 days: Restrict network access to monitoring endpoints to administrative networks only via firewall or load balancer rules; implement input validation on pagination parameters or deploy WAF rules rejecting excessive offset/limit values. Within 30 days: Monitor nats-io/nats-server GitHub repository and CISA advisories for patch availability; develop and test upgrade plan in non-production environment; schedule production deployment upon patch release.

NATS Server CVE-2026-58207

Q: Which versions of NATS Server are affected by CVE-2026-58207?

NATS Server contains a high-severity denial-of-service vulnerability affecting HTTP monitoring endpoints (/connz and /subsz) that allows any network-accessible client to crash the entire message…. A patch is available.

EUVD-2026-42389 MEDIUM

Integer Overflow or Wraparound (CWE-190)

2026-07-06 vendor:ubuntu

Information Disclosure Integer Overflow Red Hat Nats Server Linuxfoundation

6.5

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach NATS monitoring HTTP port
Delivery

Send /connz or /subsz request with offset=MaxInt64
Exploit

Offset+Limit overflows to negative
Execution

Invalid slice index triggers panic
Impact

Broker process crashes (DoS)

Vulnerability Assessment

Weakness	CWE CWE-190 ASVS 5.0 V15 - Secure Coding and Architecture Integer overflow checks MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires that the NATS Server HTTP monitoring interface be enabled and reachable by the attacker, and that a request reach the /connz or /subsz endpoint with a crafted offset value near math.MaxInt64 (e.g., offset=9223372036854775807 with limit=1) so the sum overflows. For /subsz the subscriptions view (subs=1) is the affected path. Limiting factors: the monitoring port is a separate, optional interface that is frequently bound to localhost or firewalled in hardened deployments, and the CVSS PR:L indicates some privilege/access to that interface is expected - so environments that do not expose monitoring externally are not remotely exploitable. No user interaction is required, and default builds include the monitoring server only when explicitly configured.
Impact	The assigned CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H (7.7) describes a network-reachable, low-complexity, availability-only impact requiring low privileges - consistent with a DoS that crashes the broker with no confidentiality or integrity loss. This is a genuine availability concern for exposed monitoring ports but not a code-execution or data-theft issue. Notably, the vendor tags list 'Information Disclosure' alongside 'Integer Overflow,' yet the CVSS impact metrics set C:N/I:N - this is a conflict: the source evidence (panic on overflow) supports availability impact only, so treat the 'Information Disclosure' tag as unverified. No EPSS score, KEV listing, POC, or SSVC decision data was provided; absent active-exploitation signals and given availability-only impact, this is a moderate-priority patch, prioritized higher only where the monitoring endpoint is network-exposed.
Exploit ScenarioDerived	An attacker with access to the NATS monitoring HTTP port sends a request such as GET /connz?offset=9223372036854775807&limit=1 (or the equivalent /subsz?subs=1&offset=...&limit=1), causing the offset+limit addition to overflow and the server to panic. Because impact is availability-only, the result is a crash of the broker and disruption of all messaging clients; no public exploit code was provided, but the added regression tests demonstrate the exact overflowing inputs.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jul 08, 2026

Denial of service in NATS Server (nats-io/nats-server) affects the HTTP monitoring endpoints /connz and /subsz, where attacker-controlled offset and limit pagination parameters trigger a signed integer overflow (Offset+Limit wrapping from math.MaxInt64 to math.MinInt64), producing invalid slice bounds and a server panic. Any client able to reach the monitoring interface can crash the broker, disrupting all connected messaging clients. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; the upstream fix clamps offsets using min/max bounds.

Earlier versions of this analysis (2)

v2 Jul 08, 2026 - 21:30 cvss changed CVSS 7.7

Denial of service in NATS Server monitoring endpoints (nats-server, versions prior to 2.12.12 and 2.14.x prior to 2.14.3) allows a client to crash the server by supplying an extreme pagination offset to the /connz or /subsz HTTP monitoring APIs. Supplying Offset=math.MaxInt64 with Limit=1 causes the Offset+Limit sum to overflow to math.MinInt64, producing an out-of-range slice computation that panics the process. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the fix is confirmed in the vendor advisory GHSA-q59r-vq66-pxc2 and tagged releases.

v1 Jul 06, 2026 - 20:21

CVE-2026-58207 is a vulnerability reported by the Ubuntu vendor with no public description, CVSS score, CWE classification, or technical details available at time of analysis. The sole intelligence signal is a vendor disclosure from Ubuntu, indicating it affects some component within the Ubuntu Linux ecosystem. Without a description, the impact, affected versions, and exploitation conditions cannot be determined.

RemediationAI

Upgrade to a fixed release: Vendor-released patch v2.12.12 (2.12.x line) or v2.14.3 (2.14.x line), available at https://github.com/nats-io/nats-server/releases/tag/v2.12.12 and https://github.com/nats-io/nats-server/releases/tag/v2.14.3; review GHSA-q59r-vq66-pxc2 for the full advisory. If immediate patching is not possible, restrict or disable the HTTP monitoring interface: bind the monitoring port (default 8222 HTTP / 8443 HTTPS) to localhost only, place it behind a firewall or reverse proxy that rejects unauthenticated access, and block external reachability to /connz and /subsz - the trade-off is loss of remote observability and any dashboards or scrapers that poll those endpoints. Where monitoring must stay enabled, front it with a proxy that validates/clamps the offset and limit query parameters to sane ranges.

Affected VersionsENISA

nats-server 2.14.0-RC.1, < 2.14.3

nats-server < 2.12.12

Affected Packages

euvd nats_server fix: 2.12.12

euvd nats_server_2_14_0_rc_1 fix: 2.14.3

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

NATS Server is a high-performance, CNCF-hosted messaging system written in Go that exposes an optional HTTP monitoring interface. The flaw is a CWE-190 Integer Overflow in server/monitor.go inside the Connz() and Subsz() pagination logic: the code computed maxoff := Offset + Limit before bounds-checking, so with Offset near math.MaxInt64 the addition overflows into a negative value (math.MinInt64). The negative/out-of-range result then feeds slice indexing over the client/subscription arrays, causing a runtime panic. The patched code replaces the naive addition with saturating arithmetic (minoff := min(max(Offset,0), maxIndex); maxoff := minoff + min(Limit, maxIndex-minoff)), which is confirmed by the fix commits and the added regression tests TestMonitorConnzOffsetOverflow and TestMonitorSubszOffsetOverflow.

Know when Nats Server gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (vendor:ubuntu) PRIMARY HIGH

NVD 6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI 6.5 MEDIUM

Network-reachable low-complexity overflow crashing the broker gives A:H with no C/I; PR:L reflects access to the monitoring interface, and the panic stays within one security authority so S:U.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat 6.5 MEDIUM

Primary rating from Vendor (vendor:ubuntu).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Severity Changed

Jul 09, 2026 - 19:22 NVD

HIGH MEDIUM

CVSS changed

Jul 09, 2026 - 19:22 NVD

7.7 (HIGH) 6.5 (MEDIUM)

Patch available

Jul 08, 2026 - 22:04 EUVD

Analysis Updated

Jul 08, 2026 - 21:30 vuln.today

v3 - CVSS changed

Analysis Updated

Jul 08, 2026 - 21:30 vuln.today

v2 - CVSS changed

CVSS changed

Jul 08, 2026 - 21:22 NVD

7.7 (HIGH)

DescriptionNVD

[Unknown description]

Executive ViewAI

Why It Matters

NATS Server contains a high-severity denial-of-service vulnerability affecting HTTP monitoring endpoints (/connz and /subsz) that allows any network-accessible client to crash the entire message broker by exploiting integer overflow in pagination parameters. Although no public exploit code has been identified, the vulnerability poses critical availability risk to organizations relying on NATS for production messaging infrastructure. Immediate network isolation of monitoring interfaces is required to prevent potential operational disruption.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict HTTP monitoring endpoint access to trusted administrative networks only using network-layer controls; (2) Require HTTP basic authentication on /connz and /subsz if available in your NATS configuration; (3) Deploy WAF or API gateway rules to validate and reject pagination parameters exceeding safe integer ranges; (4) Enable detailed logging and alerting on monitoring endpoint access and unusual connection terminations; (5) Maintain network segmentation preventing untrusted clients from reaching monitoring interfaces; (6) Establish broker health monitoring and restart procedures for rapid incident response.

Threat Intelligence Overview

EPSS Score

0.5%

Top 58% exploitable

Prevalence

Medium

widely used CNCF cloud-native messaging broker, but monitoring port often internal

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment MSRC Vendor

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.5%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +32

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Integer Overflow MEDIUM

Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.