Cloudanix VulnDB

CVE-2026-33218

High · 7.5

CVSS

7.5

EPSS

0.9%

Published

Mar 25, 2026

CISA due date

—

The record

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a client which can connect to the leafnode port can crash the nats-server with a certain malformed message pre-authentication. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, disable leafnode support if not needed or restrict network connections to the leafnode port, if plausible without compromising the service offered.

Affected packages

Ecosystem Package Introduced Fixed
Chainguard k3s 0 1.35.2.1-r4
Chainguard k3s-1.32 0 1.32.13.1-r7
Chainguard k3s-1.33 0 1.33.9.1-r6
Chainguard k3s-static 0 1.35.2.1-r4
Chainguard k3s-static-1.32 0 1.32.13.1-r7
Chainguard k3s-static-1.33 0 1.33.9.1-r6
Chainguard kine 0 0.14.15-r1
Chainguard milvus-2.5 0 2.5.27-r4
Chainguard nats 0 0.3.2-r0
Chainguard nats-fips 0 0.3.2-r0
Chainguard nats-top 0 0.6.3-r18
Chainguard nats-top-fips 0 0.6.3-r16
Chainguard prometheus-nats-exporter 0 0.19.1-r4
Chainguard prometheus-nats-exporter-fips 0 0.19.1-r4
Chainguard rke2-runtime-1.33 0 1.33.9.2.1-r3
Chainguard rke2-runtime-1.34 0 1.34.5.2.1-r3
Chainguard rke2-runtime-1.35 0 1.35.2.2.1-r3
Chainguard rke2-runtime-fips-1.34 0 1.34.6.2.1-r2
Chainguard rke2-runtime-fips-1.35 0 1.35.2.2.1-r2
Chainguard telegraf-1.37 0 1.37.3-r6
Chainguard telegraf-1.38 0 1.38.1-r1
Wolfi k3s 0 1.35.2.1-r4
Wolfi k3s-1.32 0 1.32.13.1-r7
Wolfi k3s-1.33 0 1.33.9.1-r6
Wolfi k3s-static 0 1.35.2.1-r4
Wolfi k3s-static-1.32 0 1.32.13.1-r7
Wolfi k3s-static-1.33 0 1.33.9.1-r6
Wolfi kine 0 0.14.15-r1
Wolfi nats 0 0.3.2-r0
Wolfi nats-top 0 0.6.3-r18
Wolfi prometheus-nats-exporter 0 0.19.1-r4
Wolfi telegraf-1.37 0 1.37.3-r6
Wolfi telegraf-1.38 0 1.38.1-r1
openSUSE:Leap 15.6 govulncheck-vulndb 0 0.0.20260326T203309-150000.1.155.2

Related vulnerabilities