NATS-Server Pre-Authentication Denial-of-Service Vulnerability in Leafnode Handling

A denial-of-service vulnerability has been identified in NATS-Server versions prior to 2.12.6 and 2.11.15. The issue arises in the leafnode handling, where a client can crash the server by sending a malformed message before authentication. This vulnerability can be exploited by any client that can connect to the leafnode port.

Impact

Exploitation of this vulnerability leads to a server panic, causing the NATS server to crash.

Remediation

Users can upgrade to NATS-Server versions 2.12.6 or 2.11.15. If an upgrade is not possible, leafnode support can be disabled or network connections to the leafnode port can be restricted, if feasible without disrupting service.