CVE-2019-13126 Integer Overflow or Wraparound in NATS Server
A remote attacker can crash the NATS server via a crafted request causing an integer overflow, requiring authentication if enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-13126?
CVE-2019-13126 is a high-severity vulnerability in n/a, published on 29 Jul 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An integer overflow in NATS Server before 2.0.2 allows a remote attacker to crash the server by sending a crafted request. If authentication is enabled, then the remote attacker must have first authenticated.
Weakness: CWE-190
Which versions are affected by CVE-2019-13126?
4 open source packages ship an affected version, including github.com/nats-io/nats-server/v2 and github.com/nats-io/nats-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/nats-io/nats-server/v2 Go | All versions | 2.2.0 |
github.com/nats-io/nats-server/v2 Go | All versions | 2.2.0 |
github.com/nats-io/nats-server/v2 Go | All versions | 2.2.0 |
github.com/nats-io/nats-server Go | All versions | None |
Products include Linuxfoundation Nats-Server.
How do I fix CVE-2019-13126?
Upgrade github.com/nats-io/nats-server/v2 to 2.2.0 or later.
Is CVE-2019-13126 being exploited?
There is no known exploitation of CVE-2019-13126 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2022-28357 NATS nats-server allows directory traversal via unintended path to a management action
- CVE-2026-58253 NATS Server: Route API Auth Bypass
- CVE-2022-24450 Incorrect Authorization in NATS nats-server
- CVE-2026-33216 NATS has MQTT plaintext password disclosure
- CVE-2026-58207 NATS Server: Remote crash via integer overflow in Connz pagination
Sources
Also known as GHSA-jp4j-47f9-2vc3, GO-2022-0852.