CVE-2026-33218
Fixed in a distro release EPSS <1%CVSS 7.5
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a client which can connect to the leafnode port can crash the nats-server with a certain malformed message pre-authentication. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, disable leafnode support if not needed or restrict network connections to the leafnode port, if plausible without compromising the service offered.
Products: nats-io nats-server, Red Hat Multicluster Global Hub 1.4.5, Red Hat Multicluster Global Hub 1.6.5, Red Hat multicluster global hub 1.5.3, Red Hat OpenShift Container Platform 4
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/nats-io/nats-server | no fix |
| Go | github.com/nats-io/nats-server/v2 | 2.11.15 |
| Go | github.com/nats-io/nats-server/v2 | 2.12.6 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | k3s | 1.35.2.1-r4 |
| Chainguard | k3s-1.32 | 1.32.13.1-r7 |
| Chainguard | k3s-1.33 | 1.33.9.1-r6 |
| Chainguard | k3s-static | 1.35.2.1-r4 |
| Chainguard | k3s-static-1.32 | 1.32.13.1-r7 |
| Chainguard | k3s-static-1.33 | 1.33.9.1-r6 |
| Chainguard | kine | 0.14.15-r1 |
| Chainguard | milvus-2.5 | 2.5.27-r4 |
| Chainguard | nats | 0.3.2-r0 |
| Chainguard | nats-fips | 0.3.2-r0 |
| Chainguard | nats-top | 0.6.3-r18 |
| Chainguard | nats-top-fips | 0.6.3-r16 |
| Chainguard | prometheus-nats-exporter | 0.19.1-r4 |
| Chainguard | prometheus-nats-exporter-fips | 0.19.1-r4 |
| Chainguard | rke2-runtime-1.31 | no fix |
| Chainguard | rke2-runtime-1.32 | no fix |
| Chainguard | rke2-runtime-1.33 | 1.33.9.2.1-r3 |
| Chainguard | rke2-runtime-1.34 | 1.34.5.2.1-r3 |
| Chainguard | rke2-runtime-1.35 | 1.35.2.2.1-r3 |
| Chainguard | rke2-runtime-fips-1.31 | no fix |
| Chainguard | rke2-runtime-fips-1.32 | no fix |
| Chainguard | rke2-runtime-fips-1.33 | 1.33.10.2.3-r2 |
| Chainguard | rke2-runtime-fips-1.34 | 1.34.6.2.1-r2 |
| Chainguard | rke2-runtime-fips-1.35 | 1.35.2.2.1-r2 |
| Chainguard | telegraf-1.35 | no fix |
| Chainguard | telegraf-1.36 | no fix |
| Chainguard | telegraf-1.37 | 1.37.3-r6 |
| Chainguard | telegraf-1.38 | 1.38.1-r1 |
| Debian 12 | nats-server | no fix |
| Debian 13 | nats-server | no fix |
| Debian 14 | nats-server | 2.12.6-1 |
| Ubuntu 24.04 LTS | nats-server | no fix |
| Ubuntu 25.10 | nats-server | no fix |
| Ubuntu 26.10 | nats-server | no fix |
| Ubuntu Pro 26.04 LTS | nats-server | no fix |
| Wolfi | k3s | 1.35.2.1-r4 |
| Wolfi | k3s-1.32 | 1.32.13.1-r7 |
| Wolfi | k3s-1.33 | 1.33.9.1-r6 |
| Wolfi | k3s-static | 1.35.2.1-r4 |
| Wolfi | k3s-static-1.32 | 1.32.13.1-r7 |
| Wolfi | k3s-static-1.33 | 1.33.9.1-r6 |
| Wolfi | kine | 0.14.15-r1 |
| Wolfi | nats | 0.3.2-r0 |
| Wolfi | nats-top | 0.6.3-r18 |
| Wolfi | telegraf-1.36 | no fix |
| Wolfi | telegraf-1.37 | 1.37.3-r6 |
| Wolfi | telegraf-1.38 | 1.38.1-r1 |
| openSUSE Leap 15.6 | govulncheck-vulndb | 0.0.20260326T203309-150000.1.155.2 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |