Security readout for executives and security teams
Plain-English summary
An unauthenticated attacker who can reach a vulnerable NATS leafnode port may crash the server, interrupting messaging services. Exposure is limited to deployments with leafnodes enabled, which is not the default, and compression enabled. The issue affects availability; the supplied CVSS vector indicates no confidentiality or integrity impact.
Executive priority
Prioritize exposed leafnode deployments because a remote, unauthenticated party could disrupt messaging-dependent operations. Patch internet-accessible or broadly reachable instances urgently. Internal-only instances still warrant prompt remediation based on service criticality and reachable threat paths.
Technical view
Malformed compression handling on an accessible leafnode listener can trigger a pre-authentication panic. Affected releases are nats-server before 2.11.14 and versions from 2.12.0-RC.1 through 2.12.4. Compression is enabled by default when leafnodes are used. The issue is categorized as CWE-409 and CWE-476 and scored CVSS 3.1 7.5.
Likely exposure
Highest risk exists where an affected nats-server exposes a leafnode port to untrusted networks. Deployments without leafnodes are not affected according to the advisory. Leafnode deployments with compression explicitly disabled have the documented workaround, though version verification remains important.
Exploitation context
The attack requires network access to the leafnode port but requires no authentication, privileges, or user interaction. Complexity is rated low and successful triggering causes a server crash. The supplied record is not marked KEV and provides no evidence of active exploitation.
Researcher notes
The documented impact is a pre-authentication denial of service through panic, not data disclosure or modification. Assess effective configuration and listener reachability alongside package versions. The supplied sources identify fixed versions and a compression-disable workaround, but do not establish public exploitation or inclusion in KEV.
Mitigation direction
- Upgrade nats-server 2.11.x deployments to version 2.11.14 or later.
- Upgrade nats-server 2.12.x deployments to version 2.12.5 or later.
- If upgrading immediately is impossible, disable compression on the leafnode port.
- Restrict leafnode port access to trusted systems while remediation is pending.
Validation and detection
- Inventory nats-server versions across production, staging, edge, and container deployments.
- Confirm whether each server has leafnode configuration enabled.
- Check whether compression is enabled on every configured leafnode listener.
- Verify network controls prevent untrusted clients from reaching leafnode ports.
- After remediation, confirm deployed versions and effective runtime configuration.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-409: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-29785 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6GitHub_MCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6redhat-SADPVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Made public.
- CVE publishedCVE Program
The CVE record was published.
- ADP timelineredhat-SADP
Reported to Red Hat.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-03-25T20:01:35.121Z: Reported to Red Hat.
- 2026-03-25T19:38:44.587Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/nats-io/nats-server/security/advisories/GHSA-52jh-2xxh-pwh6CVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/nats-io/nats-server/commit/a1488de6f2ba6e666aef0f9cce0016f7f167d6a8CVE reference, GitHub_M · x_refsource_MISC
- https://advisories.nats.io/CVE/secnote-2026-04.txtCVE reference, GitHub_M · x_refsource_MISC
- https://access.redhat.com/security/cve/CVE-2026-29785CVE reference, redhat-SADP · vdb-entry, x_refsource_REDHAT
- RHBZ#2451444CVE reference, redhat-SADP · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29785.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:22347CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:23345CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:21769CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Handling of Highly Compressed Data (Data Amplification)
Improper Handling of Highly Compressed Data (Data Amplification) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.