CVE-2026-58207: 
NixOS vulnerability analysis and mitigation

CVE-2026-58207 is an integer overflow vulnerability in the NATS Server Connz (and Subsz) pagination handler that allows an authenticated client to remotely crash the server. It affects NATS Server versions up to and including v2.12.11 and v2.14.0-RC.1 through v2.14.2. The vulnerability was disclosed on June 29, 2026 via a GitHub Security Advisory and assigned a CVSS v3.1 base score of 7.7 (High) by the GitHub advisory (GitHub Advisory), while NVD scores it at 6.5 (Medium) (Feedly).

The root cause is an integer overflow or wraparound (CWE-190) in server/monitor.go within the Connz() and Subsz() functions. The vulnerable code computed maxoff = c.Offset + c.Limit without bounds checking, meaning that supplying values such as Offset = math.MaxInt64 and Limit = 1 causes the sum to wrap to math.MinInt64, producing a negative slice index that triggers a Go runtime panic and crashes the server (GitHub Advisory, Patch Commit). The affected request path is account-scoped, but the overflow occurs before the response window is safely bounded. On no-auth deployments, any client with network access to the client listener can reach this path; in multi-tenant deployments, exploitability depends on whether a tenant can publish to the imported account monitoring request subject (GitHub Advisory).

Successful exploitation results in a complete denial of service — the NATS Server process crashes immediately upon receiving the malformed pagination request, interrupting all messaging for any applications relying on the server. There is no confidentiality or integrity impact; the vulnerability is purely an availability issue. In clustered or multi-tenant environments, a single malicious tenant could disrupt messaging for all other tenants sharing the same server instance (GitHub Advisory, Feedly).

1. Identify target: Locate a NATS Server instance running a vulnerable version (≤ v2.12.11 or v2.14.0-RC.1 through v2.14.2) that is accessible over the network.
2. Obtain credentials: Acquire any valid client credentials with account-scoped access. On no-auth deployments, no credentials are needed — any client with network access to the client listener port suffices.
3. Connect to the server: Establish a NATS client connection to the target server using a standard NATS client library or tool.
4. Send malformed Connz request: Issue a connection monitoring (Connz) request with overflow-inducing pagination values, for example Offset = math.MaxInt64 (9223372036854775807) and Limit = 1. This can be done via the HTTP monitoring endpoint (e.g., GET /connz?offset=9223372036854775807&limit=1) or via the account-scoped system subject.
5. Trigger server crash: The addition Offset + Limit overflows to a negative integer, causing an invalid slice index in Go's runtime, which panics and crashes the NATS Server process, resulting in a denial of service for all connected clients (GitHub Advisory, Patch Commit).

• Logs: NATS Server logs showing a Go runtime panic with a stack trace referencing server/monitor.go in the Connz() or Subsz() function; log entries indicating an unexpected server shutdown or crash.
• Network: HTTP requests to the NATS monitoring endpoint (default port 8222) with extremely large offset or limit query parameters (e.g., values near 9223372036854775807); account-scoped system subject messages with anomalous pagination fields.
• Process: Sudden termination of the nats-server process without a graceful shutdown signal; automatic restart of the NATS Server process by a supervisor (e.g., systemd, Kubernetes) shortly after a crash.

Upgrade NATS Server to v2.14.3 or v2.12.12, which contain the fix that bounds Offset and Limit values before performing arithmetic (GitHub Release v2.14.3, GitHub Release v2.12.12). If immediate upgrade is not possible, restrict publish access to system request subjects for untrusted users, and avoid no-auth deployments where untrusted clients can publish to system request subjects (GitHub Advisory). Additionally, implementing rate limiting on Connz/Subsz monitoring requests can reduce exposure.

The vulnerability was credited to researcher @larrasket in the GitHub Security Advisory (GitHub Advisory). Red Hat tracked the issue via Bugzilla and published a CVE advisory page (Red Hat CVE). No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability database indexing.