What is the CVSS score of EUVD-2026-42348?

EUVD-2026-42348 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.7%.

Which versions of NATS Server are affected by EUVD-2026-42348?

NATS Server message broker deployments are vulnerable to a remote denial-of-service attack via the MQTT handler that allows unauthenticated attackers to crash instances by exhausting server memory.. A patch is available.

How to fix or mitigate EUVD-2026-42348?

Within 24 hours: Identify all NATS Server deployments in production and document current versions. Within 7 days: Upgrade affected NATS Server instances to patched versions available per the GitHub Security Advisory. Within 30 days: Validate stable operation of upgraded deployments and document completion of remediation.

NATS Server EUVD-2026-42348

| CVE-2026-58210 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-07-06 vendor:ubuntu

Denial Of Service Red Hat Nats Server Linuxfoundation

7.5

CVSS 3.1 · Vendor: vendor:ubuntu

Severity by source

Vendor (vendor:ubuntu) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Pre-authentication MQTT parser reachable over the network with a single crafted packet (AV:N/AC:L/PR:N/UI:N); impact is resource exhaustion, so A:H with C:N/I:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (vendor:ubuntu).

CVSS VectorVendor: vendor:ubuntu

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jul 08, 2026 - 21:04 EUVD

Source Code Evidence Fetched

Jul 08, 2026 - 20:33 vuln.today

Analysis Updated

Jul 08, 2026 - 20:33 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 08, 2026 - 20:33 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 08, 2026 - 20:22 vuln.today

cvss_changed

CVSS changed

Jul 08, 2026 - 20:22 NVD

7.5 (HIGH)

Analysis Generated

Jul 06, 2026 - 20:19 vuln.today

DescriptionCVE.org

[Unknown description]

AnalysisAI

Denial of service in NATS Server (nats-server) MQTT handler allows a remote, unauthenticated client to exhaust server memory by sending an MQTT CONNECT packet that declares a large variable-length 'remaining length' before authentication completes. Because the pre-connection MQTT parser failed to enforce the configured max_payload limit, the server would buffer attacker-controlled data unbounded, degrading or crashing the broker (CVSS 7.5, availability-only impact). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the fix is confirmed by upstream commits, releases, and a GitHub Security Advisory.

Technical ContextAI

NATS Server is a CNCF messaging system that, in addition to its native protocol, exposes an optional MQTT 3.1.1 listener. MQTT packets begin with a fixed header whose second element is a variable-length integer ('remaining length') indicating the size of the rest of the packet. The affected code path in server/mqtt.go (mqttParse → mqttReader.readPacketLen/readPacketLenWithCheck) parsed and accumulated inbound bytes for a not-yet-connected client without applying the server's max_payload cap, an instance of CWE-400 (Uncontrolled Resource Consumption). The patched code introduces readVarInt plus a maxLen parameter (int32(jwt.NoLimit) once connected, otherwise atomic c.mpay), returns ErrMaxPayload when the computed packet length exceeds the limit, and triggers maxPayloadViolation to disconnect the offending client - while a separate test (TestMQTTMaxPayloadDoesNotCapPublishTopic) confirms the cap must not wrongly restrict legitimate publish topics.

RemediationAI

Vendor-released patch: upgrade nats-server to v2.12.12 (https://github.com/nats-io/nats-server/releases/tag/v2.12.12) or v2.14.3 (https://github.com/nats-io/nats-server/releases/tag/v2.14.3), which enforce the max_payload limit during pre-connection MQTT parsing (fixing commits bce9ef39469e610aeddb819194ceb7f7edfc0861 and e016e47bbf70304945f2ae9dc397e4862adefaf5). If immediate patching is not possible, the most effective compensating control is to disable the MQTT listener (remove the mqtt {} block) where it is not required, which eliminates the vulnerable code path entirely but breaks any MQTT clients; where MQTT is needed, restrict the MQTT port to trusted networks via firewall/security-group rules and place it behind an authenticating proxy or mTLS to reduce unauthenticated reachability, at the cost of added connection overhead. Setting a conservative max_payload does not fully mitigate the pre-authentication case on unpatched servers, so network restriction plus upgrade is the correct combination; see the advisory GHSA-r72h-j7qq-v6qg for details.