{
  "threat_severity" : "Moderate",
  "public_date" : "2026-02-24T15:59:17Z",
  "bugzilla" : {
    "description" : "nats-server: WebSockets pre-auth memory DoS",
    "id" : "2442401",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2442401"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-770",
  "details" : [ "NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The WebSockets handling of NATS messages handles compressed messages via the WebSockets negotiated compression. Prior to versions 2.11.2 and 2.12.3, the implementation bound the memory size of a NATS message but did not independently bound the memory consumption of the memory stream when constructing a NATS message which might then fail validation for size reasons. An attacker can use a compression bomb to cause excessive memory consumption, often resulting in the operating system terminating the server process. The use of compression is negotiated before authentication, so this does not require valid NATS credentials to exploit. The fix, present in versions 2.11.2 and 2.12.3, was to bounds the decompression to fail once the message was too large, instead of continuing on. The vulnerability only affects deployments which use WebSockets and which expose the network port to untrusted end-points.", "A flaw was found in nats-server. The WebSockets implementation fails to enforce a memory allocation limit during the decompression of WebSocket messages. A malicious compressed payload allows an attacker to cause an excessive memory consumption, eventually resulting in a server crash and a complete denial of service." ],
  "statement" : "This flaw does not require valid NATS credentials to be exploited as the use of compression is negotiated before the authentication process. However, only deployments using WebSockets and that are exposed to untrusted network endpoints are vulnerable to this issue, limiting its exposure. Due to these reasons, this issue has been rated with a moderate severity.",
  "affected_release" : [ {
    "product_name" : "Multicluster Global Hub 1.5.4",
    "release_date" : "2026-03-19T00:00:00Z",
    "advisory" : "RHSA-2026:5110",
    "cpe" : "cpe:/a:redhat:multicluster_globalhub:1.5::el9",
    "package" : "multicluster-globalhub/multicluster-globalhub-grafana-rhel9:sha256:7a5453ebb841bfcaae1b15c823a6ca2e4714d4028a457d5687d412ee568c2062"
  }, {
    "product_name" : "Multicluster Global Hub 1.6.2",
    "release_date" : "2026-03-31T00:00:00Z",
    "advisory" : "RHSA-2026:6226",
    "cpe" : "cpe:/a:redhat:multicluster_globalhub:1.6::el9",
    "package" : "multicluster-globalhub/multicluster-globalhub-grafana-rhel9:sha256:035d205705b2efd62713bea9d05cffdc5db7a437f050c4a3e3f12746b05c29d4"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Affected",
    "package_name" : "rhacm2/observatorium-rhel9",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Ceph Storage 7",
    "fix_state" : "Affected",
    "package_name" : "rhceph/snmp-notifier-rhel9",
    "cpe" : "cpe:/a:redhat:ceph_storage:7"
  }, {
    "product_name" : "Red Hat Ceph Storage 8",
    "fix_state" : "Affected",
    "package_name" : "rhceph/snmp-notifier-rhel9",
    "cpe" : "cpe:/a:redhat:ceph_storage:8"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Not affected",
    "package_name" : "openshift4/oc-mirror-plugin-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-27571\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-27571\nhttps://github.com/nats-io/nats-server/commit/f77fb7c4535e6727cc1a2899cd8e6bbdd8ba2017\nhttps://github.com/nats-io/nats-server/releases/tag/v2.11.12\nhttps://github.com/nats-io/nats-server/releases/tag/v2.12.3\nhttps://github.com/nats-io/nats-server/security/advisories/GHSA-qrvq-68c2-7grw" ],
  "name" : "CVE-2026-27571",
  "mitigation" : {
    "value" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
    "lang" : "en:us"
  },
  "csaw" : false
}