Bug 2451444 (CVE-2026-29785) - CVE-2026-29785 github.com/nats-io/nats-server: NATS-Server: Denial of Service via leafnode compression
Summary: CVE-2026-29785 github.com/nats-io/nats-server: NATS-Server: Denial of Service...
Keywords:
Status: NEW
Alias: CVE-2026-29785
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2451493
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-03-25 20:02 UTC by OSIDB Bzimport
Modified: 2026-03-25 21:13 UTC (History)
5 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-03-25 20:02:00 UTC 
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.14 and 2.12.5, if the nats-server has the "leafnode" configuration enabled (not default), then anyone who can connect can crash the nats-server by triggering a panic. This happens pre-authentication and requires that compression be enabled (which it is, by default, when leafnodes are used). Versions 2.11.14 and 2.12.5 contain a fix. As a workaround, disable compression on the leafnode port.
Note You need to log in before you can comment on or make changes to this bug.