CVE-2026-33218: linuxfoundation nats-server Improper Input Validation
CVSS: 7.5v3.1HighModified
AliasesUBUNTU-CVE-2026-33218DEBIAN-CVE-2026-33218CGA-2r76-3px7-73fgCGA-3jh6-2hr9-jpjhCGA-3mf3-rrj4-88g3CGA-463x-2vjr-826qCGA-4v2h-r36h-vmjxCGA-57mc-23wq-frhqCGA-5mq4-mv8w-g3g7CGA-6cmf-4f5f-jg6fCGA-6gvv-8pxh-7r5rCGA-733v-xfj2-65qjCGA-7q7g-wfgh-97q8CGA-86q4-jpc4-2chxCGA-cpjh-2xcv-249cCGA-f6p8-x69q-gmw6CGA-g55g-2mvf-vcjfCGA-gv46-2p34-3qgjCGA-h6vr-38qr-cxmjCGA-hf3p-6qxq-mfmrCGA-hwg9-65q9-f9j7CGA-qggw-9pj5-528mCGA-r3gj-qmjw-3479CGA-v932-xxwr-h7h6CGA-wmm8-m27c-9xcqCGA-xw5r-hf7w-892hGHSA-vprv-35vv-q339BIT-nats-2026-33218GO-2026-4837CGA-258v-673j-2vqcCGA-25w6-54h6-p943CGA-4mx3-qmrp-5686CGA-5gv3-c9hv-c77mCGA-5m3h-6mfq-r46xCGA-66gf-v2hf-75hfCGA-6pv2-jm32-5ffxCGA-7pr3-w48w-95mcCGA-86g2-4wvf-gqxrCGA-8j6p-72pr-2m8xCGA-8v28-6fv9-fc98CGA-97qx-7mgw-43r6CGA-f5vh-fhcr-q3c7CGA-g27m-c8v2-qm43CGA-g364-rhxh-2r92CGA-g6pm-q24q-g348CGA-gr57-32xm-x9vxCGA-hcwc-mfjw-g62wCGA-hg7v-f79c-2m3rCGA-hh25-86xm-h3xcCGA-jhh9-fr2x-cg7jCGA-jx2v-w586-j242CGA-p5x6-v65g-9x6pCGA-p863-xm3w-wh5wCGA-pcp6-66fm-24h9CGA-pvg4-gc9p-j8pfCGA-qmrc-5vj4-h7pgCGA-r46j-497g-jwm8CGA-w45j-jxwh-c7jrCGA-w58x-mrmh-95q6CGA-w7vh-54c3-9q6pCGA-x767-2cpq-77wj
Published 25-03-2026Last modified 09-09-2026
Vulnerability summary
CVE-2026-33218 is a high (CVSS 7.5) Improper Input Validation vulnerability in linuxfoundation nats-server. EPSS estimates a 0.84% chance of exploitation in the next 30 days, higher than 57.2% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (CVE.org)EPSS score
0.84%
0%100%
Low · +0.23 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 2 · Related 3Timeline
- 25-03-2026PublishedVulnerability first disclosed.
- 09-09-2026Last modifiedVulnerability information updated.
Description
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a client which can connect to the leafnode port can crash the nats-server with a certain malformed message pre-authentication. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, disable leafnode support if not needed or restrict network connections to the leafnode port, if plausible without compromising the service offered.
CVSS metrics
7 scores · 7 sources · 1 versionHigh 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 7 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · GoEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.84%
Chance of exploitation in the next 30 days
Percentile
57%
Versus all other CVEs
30-day change
+0.23 pp
From 0.62% on 20-09-2026
20-09-202620-10-2026
EPSS score0.84%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-1286Improper Validation of Syntactic Correctness of InputThe product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax.
Affected systems
Chainguard28 products
- k3s< 1.35.2.1-r4
- k3s-1.32< 1.32.13.1-r7
- k3s-1.33< 1.33.9.1-r6
- k3s-static< 1.35.2.1-r4
- k3s-static-1.32< 1.32.13.1-r7
Wolfi12 products
- k3s< 1.35.2.1-r4
- k3s-1.32< 1.32.13.1-r7
- k3s-1.33< 1.33.9.1-r6
- k3s-static< 1.35.2.1-r4
- k3s-static-1.32< 1.32.13.1-r7
Debian1 product
- nats-serverAll versions (No fix recorded) | < 2.12.6-1
Github.com/nats-io1 product
- nats-serverAll versions (No fix recorded)
Github.com/nats-io/nats-server1 product
- v2< 2.11.15 | ≥ 2.12.0-RC.1, < 2.12.6
Linuxfoundation1 product
- nats-server< 2.11.15 | ≥ 2.12.0, < 2.12.6
Nats-io1 product
- nats-server< < 2.11.15 | ≥ 2.12.0-RC.1, < 2.12.6
Ubuntu1 product
- nats-serverAll versions (No fix recorded)
8 vendors · 46 products
References
14 links- github.com/nats-io/nats-server/security/advisories/GHSA-vprv-35vv-q339X Refsource CONFIRMREPORTAdvisoryWEBMitigationVendor Advisory
- advisories.nats.io/CVE/secnote-2026-10.txtX Refsource MISCREPORTAdvisoryWEBMitigationVendor Advisory
