CVE-2026-33219Allocation of Resources Without Limits or Throttling in Nats-io Nats-server V2

Severity
5.3MEDIUMNVD
GHSA7.5OSV7.5
EPSS
0.1%
top 71.75%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedMar 25
Latest updateMar 26

Description

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a malicious client which can connect to the WebSockets port can cause unbounded memory use in the nats-server before authentication; this requires sending a corresponding amount of data. This is a milder variant of CVE-2026-27571. That earlier issue was a compression bomb, this vulnerability is not. Attacks against this new issue thus require significant client ba

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitability: 3.9 | Impact: 1.4

Affected Packages4 packages

debiandebian/nats-server< nats-server 2.12.6-1 (forky)
NVDlinuxfoundation/nats-server2.12.02.12.6+1
Gogithub.com/nats-io_nats-server_v22.12.0-RC.12.12.6+1
Debianlinuxfoundation/nats-server< 2.12.6-1

🔴Vulnerability Details

4
OSV
NATS is vulnerable to pre-auth DoS through WebSockets client service in github.com/nats-io/nats-server2026-03-26
OSV
CVE-2026-33219: NATS-Server is a High-Performance server for NATS2026-03-25
GHSA
NATS is vulnerable to pre-auth DoS through WebSockets client service2026-03-24
OSV
NATS is vulnerable to pre-auth DoS through WebSockets client service2026-03-24

📋Vendor Advisories

2
Red Hat
github.com/nats-io/nats-server: NATS-Server: Denial of Service via unbounded memory use in WebSockets2026-03-25
Debian
CVE-2026-33219: nats-server - NATS-Server is a High-Performance server for NATS.io, a cloud and edge native me...2026

🕵️Threat Intelligence

1
Wiz
CVE-2026-33219 Impact, Exploitability, and Mitigation Steps | Wiz