PT-2026-21766 · Nats · Nats Server

Pavel Kohout · Published 2026-01-01 · Updated 2026-03-03 · CVE-2026-27571

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions NATS-Server versions prior to 2.11.2 NATS-Server versions prior to 2.12.3

Description NATS-Server, a high-performance messaging system, has an issue in its WebSocket implementation. The server handles compressed messages via WebSocket negotiated compression. Prior to versions 2.11.2 and 2.12.3, the implementation only bounded the size of a NATS message but did not independently bound the memory consumption during message construction. This allows an attacker to use a compression bomb, causing excessive memory consumption and potentially terminating the server process. The issue does not require valid NATS credentials to exploit, as compression negotiation occurs before authentication.

Recommendations Update NATS-Server to version 2.11.2 or later. Update NATS-Server to version 2.12.3 or later.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

CWE-409

Related Identifiers

AZL-78372

AZL-78374

BIT-NATS-2026-27571

CVE-2026-27571

GHSA-QRVQ-68C2-7GRW

GO-2026-4533

SUSE-SU-2026:0757-1

Affected Products

Nats Server

References · 132

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27571.json · Exploit
• https://github.com/nats-io/nats-server/commit/f77fb7c4535e6727cc1a2899cd8e6bbdd8ba2017 · Patch
• https://github.com/nats-io/nats-server/security/advisories/GHSA-qrvq-68c2-7grw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27571 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-27571 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-27571 · Security Note
• https://osv.dev/vulnerability/AZL-78372 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4533 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qrvq-68c2-7grw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27571 · Security Note
• https://osv.dev/vulnerability/AZL-78374 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-27571 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-nats-2026-27571 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-27571 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-27571 · Vendor Advisory