CVE-2026-33219: 
NixOS vulnerability analysis and mitigation

CVE-2026-33219 is a pre-authentication Denial of Service vulnerability in NATS-Server, the high-performance messaging server for NATS.io. A malicious client connecting to the WebSockets port can cause unbounded memory consumption in the server before authentication completes, requiring the attacker to send a proportional amount of data. It affects all nats-server versions prior to 2.11.15 and versions 2.12.0 through 2.12.5. The vulnerability was published on March 24, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): the NATS-Server WebSockets handler allocates memory for incoming client data prior to authentication without imposing bounds on the total amount that can be consumed. An unauthenticated attacker simply opens a WebSocket connection to the NATS WebSockets port and streams large volumes of data, causing the server to allocate unbounded memory. This is explicitly described as a milder variant of CVE-2026-27571 (a compression bomb); unlike that earlier issue, CVE-2026-33219 does not leverage compression amplification, so exploitation requires the attacker to supply bandwidth proportional to the memory exhaustion desired. No authentication or special privileges are required — only network access to the WebSockets port (GitHub Advisory, NATS Security Advisory).

Successful exploitation results in unbounded memory growth in the nats-server process, which can cause the operating system to terminate the server (OOM kill) or render it unresponsive, constituting a Denial of Service. There is no confidentiality or integrity impact — the vulnerability is purely an availability concern. Affected deployments include any NATS-Server instance with WebSockets enabled that is reachable by untrusted clients, such as browser-facing deployments in cloud, IoT, or edge environments (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.059% (roughly the 30th percentile), indicating a low near-term exploitation probability. Exploitation does require significant attacker bandwidth, which raises the practical bar compared to the related compression bomb variant CVE-2026-27571 (GitHub Advisory).

1. Reconnaissance: Identify NATS-Server instances with WebSockets enabled using network scanning tools (e.g., Shodan, Censys, or nmap targeting common WebSocket ports such as 443 or 8080) running versions prior to 2.11.15 or between 2.12.0 and 2.12.5.
2. Establish WebSocket connection: Connect to the NATS-Server WebSockets port using any standard WebSocket client (e.g., wscat, a browser, or a custom script) — no credentials are required at this stage.
3. Stream large data volumes: Continuously send large, uncompressed WebSocket frames or messages to the server before the authentication handshake completes, causing the server to buffer and allocate memory for each incoming payload without bound.
4. Exhaust server memory: Sustain the data stream until the server's memory is exhausted, triggering an OOM condition that causes the nats-server process to be killed by the OS or become unresponsive, resulting in denial of service for all legitimate clients (GitHub Advisory, NATS Security Advisory).

• Network: High-volume inbound traffic to the NATS WebSockets port from a single or small set of source IPs prior to any authentication exchange; sustained WebSocket connections that never complete authentication.
• Process/System: Rapidly increasing memory consumption by the nats-server process visible via top, htop, or system monitoring tools; OOM killer events in system logs (dmesg or /var/log/syslog) referencing the nats-server process.
• Logs: NATS-Server logs showing large numbers of unauthenticated WebSocket connections that remain open without progressing to authentication; connection entries from unexpected or external IP addresses on the WebSockets listener port.

Upgrade NATS-Server to version 2.11.15 or 2.12.6 (or later), which contain the fix for this vulnerability (GitHub Advisory, NATS Security Advisory). As an immediate workaround for deployments that do not require browser-based NATS clients, disable the WebSockets listener entirely in the NATS-Server configuration. Additionally, network-level controls (firewalls, ACLs) restricting access to the WebSockets port to trusted IP ranges can reduce exposure until patching is complete.

Red Hat tracked the issue as high severity in their Bugzilla system and assigned it to their Product Security DevOps Team for triage (Red Hat Bugzilla). The openSUSE security announce list also published a notification, and Linux security aggregators such as linuxsecurity.com covered the SUSE advisory. Community reaction has been relatively muted given the moderate CVSS score and the significant bandwidth requirement for exploitation.