What is the CVSS score of CVE-2026-58250?

CVE-2026-58250 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.7%.

Which versions of NATS Server are affected by CVE-2026-58250?

NATS Server is vulnerable to remote denial of service when leafnode listeners are exposed; unauthenticated attackers can crash the entire server with a single malformed protocol message.. A patch is available.

How to fix or mitigate CVE-2026-58250?

Within 24 hours: Inventory all NATS Server instances to identify which expose leafnode listeners and restrict network access to these ports to trusted internal networks only. Within 7 days: Upgrade all vulnerable instances to NATS Server v2.11.17 (for 2.11.x deployments) or v2.12.8 (for 2.12.x deployments). Within 30 days: Validate all instances are running patched versions and confirm network segmentation remains in place.

NATS Server CVE-2026-58250

EUVD-2026-42380 HIGH

NULL Pointer Dereference (CWE-476)

2026-07-06 vendor:ubuntu

Denial Of Service Null Pointer Dereference Nats Server Red Hat Suse

7.5

CVSS 3.1 · Vendor: vendor:ubuntu

Severity by source

Vendor (vendor:ubuntu) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Single unauthenticated pre-CONNECT packet to a network leafnode port crashes the process, so AV:N/AC:L/PR:N/UI:N with availability-only impact (A:H, C/I:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (vendor:ubuntu).

CVSS VectorVendor: vendor:ubuntu

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jul 08, 2026 - 21:04 EUVD

Analysis Updated

Jul 08, 2026 - 20:31 vuln.today

v3 (cvss_changed)

Source Code Evidence Fetched

Jul 08, 2026 - 20:30 vuln.today

Analysis Updated

Jul 08, 2026 - 20:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 08, 2026 - 20:22 vuln.today

cvss_changed

CVSS changed

Jul 08, 2026 - 20:22 NVD

7.5 (HIGH)

Analysis Generated

Jul 06, 2026 - 20:17 vuln.today

DescriptionCVE.org

[Unknown description]

AnalysisAI

Remote denial of service in the NATS Server (nats-io/nats-server) leafnode subsystem allows unauthenticated attackers to crash the entire server by sending a second INFO protocol message before CONNECT on the leafnode port, triggering a nil-pointer dereference (c.acc == nil) that panics the process. All server instances exposing a leafnode listener prior to v2.11.17 (2.11.x) and v2.12.8 (2.12.x) are affected. No public exploit has been identified, but the vendor's own regression test (TestLeafNodeSecondInfoBeforeConnectDoesNotPanic) demonstrates the exact crash payload, and the CVSS availability-only vector (7.5) reflects a single-packet, no-auth crash.

Technical ContextAI

NATS is a high-performance CNCF messaging system written in Go; 'leafnodes' are a topology feature that let a remote NATS server or client bridge into a hub cluster's account space over a dedicated leafnode listener. The flaw is CWE-476 (NULL Pointer Dereference) in server/leafnode.go: during the leafnode handshake, the connection's account pointer (c.acc) is only bound after the CONNECT phase, but the code paths processLeafnodeInfo() and leafNodeFinishConnectProcess() dereferenced c.acc (and 'remote') without checking for nil. An attacker who sends a second INFO frame (e.g. with a remote_account or connect_info field) after the initial compression-negotiation INFO but before CONNECT reaches these paths while c.acc is still nil, and the resulting dereference panics the Go process. The fix adds explicit nil guards that instead reply 'Authorization Violation' and cleanly close the connection with ProtocolViolation, keeping the server alive.

RemediationAI

Upgrade NATS Server to a patched release: v2.11.17 if you run the 2.11.x line or v2.12.8 if you run 2.12.x, per releases https://github.com/nats-io/nats-server/releases/tag/v2.11.17 and https://github.com/nats-io/nats-server/releases/tag/v2.12.8 and advisory https://github.com/nats-io/nats-server/security/advisories/GHSA-3g5q-cfh2-cq67 (fix commits 8dcb26eaea78fdcbe96dbee5986d6019fd5cb94a and fc5fe39177533e9dbdd651d2458285bfae1dde27). If you cannot patch immediately, restrict the leafnode listener: bind it to a trusted management interface rather than 0.0.0.0, place it behind a firewall or security group that only permits known leafnode peers, or require TLS client certificates on the leafnode port so unknown TCP peers cannot reach the vulnerable pre-CONNECT handshake; the trade-off is that any legitimate leafnode peer whose source IP or certificate is not allow-listed will lose connectivity, and if you do not actually use leafnodes, disable the leafnode block entirely to remove the exposure with no functional loss.