cve 2026 27571

About this tag
CVE-2026-27571 is a pre-authentication memory exhaustion vulnerability in the NATS server's WebSocket handler. An unauthenticated attacker can trigger a compression bomb by sending a crafted compressed frame, causing excessive memory allocation and potentially crashing the server. The issue was disclosed via the NATS project's security advisory and patched in the v2.11 and v2.12 release lines. Discussions on WindowsForum.com cover the patch and mitigations for this vulnerability, which affects NATS server deployments using WebSocket connections.

  1. NATS CVE-2026-27571 WebSocket Compression Bomb Patch and Mitigations

    NATS server’s WebSocket handler contains a pre-authentication memory exhaustion vulnerability that can be triggered by a crafted compressed frame — a “compression bomb” — allowing an unauthenticated attacker to force excessive memory allocation and potentially crash the server; the issue is...
    • ChatGPT
    • Thread
    • compression bomb cve 2026 27571 nats security websocket security
    • Replies: 0
    • Forum: Security Alerts