Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2026-29785 is a high-severity NULL Pointer Dereference (CWE-476) vulnerability in Linuxfoundation Nats-Server. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked at the 48th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-29785 is a denial-of-service vulnerability in NATS-Server, a high-performance server for the NATS.io cloud and edge native messaging system. The issue affects versions prior to 2.11.14 and 2.12.5, specifically when the non-default "leafnode" configuration is enabled. It stems from a NULL pointer dereference (CWE-476) that triggers a panic during pre-authentication handling, rated at CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
An unauthenticated remote attacker who can connect to the leafnode port can exploit this by sending crafted input, provided compression is enabled—which is the default when leafnodes are used. Successful exploitation causes the nats-server process to crash, resulting in a denial of service with high availability impact but no confidentiality or integrity effects.
NATS advisories recommend upgrading to versions 2.11.14 or 2.12.5, which contain the fix via a specific commit. As a workaround, administrators can disable compression on the leafnode port. Details are available in the NATS security advisory, GitHub security advisory GHSA-52jh-2xxh-pwh6, and the patching commit.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-15963
Vulnerability Data
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.14 and 2.12.5, if the nats-server has the "leafnode" configuration enabled (not default), then anyone who can connect can crash the nats-server by…
more
triggering a panic. This happens pre-authentication and requires that compression be enabled (which it is, by default, when leafnodes are used). Versions 2.11.14 and 2.12.5 contain a fix. As a workaround, disable compression on the leafnode port.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation (including static analysis) directly finds null-dereference bugs before deployment.
Input validation can reject or limit decompression of data whose expansion ratio exceeds safe thresholds.
Documented development standards and tools can enforce null-safety rules and safe pointer usage.
Engineering principles can mandate defensive coding such as explicit null checks before dereference.
DoS protection limits the resource-exhaustion impact when a decompression bomb is processed.
Resource allocation controls bound memory/CPU consumption that a data-amplification attack would otherwise exhaust.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices (static analysis, code review, safe coding standards) directly prevent NULL dereference bugs during development.
Runtime monitoring of compute resources can detect exhaustion caused by decompression bombs.
Capacity planning and monitoring directly limits the availability impact of data-amplification attacks.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect NULL dereference defects before release.
Redundancy helps availability but does not address the root cause of the weakness.
Monitoring can detect anomalous resource usage but does not prevent the weakness.
Secure SDLC mandates defensive coding practices that can prevent NULL dereferences.
Application security requirements can specify input validation and pointer-safety rules.
Secure architecture principles encourage defensive design that avoids unsafe pointer use.