Allocation of Resources Without Limits or Throttling in nats-server - #VU166206
Published: November 13, 2026
Vulnerability identifier: #VU166206
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service through memory and CPU exhaustion, affecting other clients and accounts, including users of other protocols.
The vulnerability exists due to insufficient enforcement of buffering limits and repeated copying of accumulated data in the NATS Server MQTT packet assembly component when assembling packets after CONNECT. A remote attacker can send an oversized or slowly completed packet to consume excessive memory and CPU before message-level checks run, causing a denial of service.
Affected software
nats-server
Remediation
Install security update from vendor's website.
nats-server - addressed in versions 2.14.8, 2.15.1