CVE-2026-58207CWE-190

NATS Server: Remote crash via integer overflow in Connz pagination

High · published July 8, 2026

CVSS v3.1
7.7
EPSS
1%
Percentile
45.9
In the wild
Unconfirmed
What it is

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, a client able to send account-scoped connection monitoring requests could crash the server by supplying Connz pagination Offset and Limit values that overflowed internal arithmetic before the response window was safely bounded. This issue is fixed in versions 2.14.3 and 2.12.12.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00560 · 45.9th percentile
Weakness
CWE-190 · Integer Overflow or Wraparound
Published
2026-07-08T20:15Z
EPSS history
Timeline
  • 08 JUL 20:15Z
    NATS Server: Remote crash via integer overflow in Connz pagination
    cvelistv5