CyberRota Analysis
AI-GeneratedNATS Server versions prior to 2.12.8 and 2.11.17 are vulnerable to a denial-of-service attack, where an unauthenticated peer can crash the server by sending multiple INFO protocol messages during the pre-authentication handshake. This vulnerability poses a significant risk to systems utilizing NATS for messaging, especially in environments where network access is not tightly controlled. Organizations using affected versions should prioritize upgrading to the patched releases to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.12.8 and 2.11.17, an unauthenticated peer with network access to a leafnode listener with compression enabled could crash the server during the pre-authentication leafnode handshake by sending repeated leafnode INFO protocol messages before authentication and account setup completed. This issue is fixed in versions 2.12.8 and 2.11.17.
Related CVEs
Other vulnerabilities affecting the same vendor(s)