CVE-2026-33248 | nats-io nats-server up to 2.11.14/2.12.5 mTLS verify_and_map certificate validation

VDB-352994 · CVE-2026-33248 · GCVE-0-2026-33248 NATS-IO NATS-SERVER UP TO 2.11.14/2.12.5 MTLS VERIFY_AND_MAP CERTIFICATE VALIDATION HISTORYDIFFRELATEJSONXMLCTI CVSS Meta Temp Score Current Exploit Price (≈) CTI Interest Score 3.6 $0-$5k 3.93 Summaryinfo A vulnerability described as critical has been identified in nats-io nats-server up to 2.11.14/2.12.5. This issue affects the function verify_and_map of the component mTLS. Such manipulation leads to certificate validation. This vulnerability is traded as CVE-2026-33248. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is recommended. Detailsinfo A vulnerability was found in nats-io nats-server up to 2.11.14/2.12.5 and classified as problematic. Affected by this issue is the function verify_and_map of the component mTLS. The manipulation with an unknown input leads to a certificate validation vulnerability. Using CWE to declare the problem leads to CWE-295. The product does not validate, or incorrectly validates, a certificate. Impacted is integrity. The advisory is available at github.com. This vulnerability is handled as CVE-2026-33248. The exploitation is known to be difficult. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1587.003 by the MITRE ATT&CK project. Upgrading to version 2.11.15 or 2.12.6 eliminates this vulnerability. Productinfo Vendor nats-io Name nats-server Version 2.11.0 2.11.1 2.11.2 2.11.3 2.11.4 2.11.5 2.11.6 2.11.7 2.11.8 2.11.9 2.11.10 2.11.11 2.11.12 2.11.13 2.11.14 2.12.0 2.12.1 2.12.2 2.12.3 2.12.4 2.12.5 CPE 2.3info 🔒 🔒 🔒 CPE 2.2info 🔒 🔒 🔒 CVSSv4info VulDB Vector: 🔒 VulDB Reliability: 🔍 CVSSv3info VulDB Meta Base Score: 3.7 VulDB Meta Temp Score: 3.6 VulDB Base Score: 3.7 VulDB Temp Score: 3.6 VulDB Vector: 🔒 VulDB Reliability: 🔍 CVSSv2info Vector Complexity Authentication Confidentiality Integrity Availability Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock VulDB Base Score: 🔒 VulDB Temp Score: 🔒 VulDB Reliability: 🔍 Exploitinginfo Class: Certificate validation CWE: CWE-295 / CWE-287 CAPEC: 🔒 ATT&CK: 🔒 Physical: No Local: No Remote: Yes Availability: 🔒 Status: Not defined Price Prediction: 🔍 Current Price Estimation: 🔒 0-Day Unlock Unlock Unlock Unlock Today Unlock Unlock Unlock Unlock Threat Intelligenceinfo Interest: 🔍 Active Actors: 🔍 Active APT Groups: 🔍 Countermeasuresinfo Recommended: Upgrade Status: 🔍 0-Day Time: 🔒 Upgrade: nats-server 2.11.15/2.12.6 Timelineinfo 03/25/2026 Advisory disclosed 03/25/2026 +0 days VulDB entry created 03/25/2026 +0 days VulDB entry last update Sourcesinfo Advisory: github.com Status: Confirmed CVE: CVE-2026-33248 (🔒) GCVE (CVE): GCVE-0-2026-33248 GCVE (VulDB): GCVE-100-352994 Entryinfo Created: 03/25/2026 09:28 Changes: 03/25/2026 09:28 (53) Complete: 🔍 Cache ID: 99:00B:101 Discussion No comments yet. Languages: en. Please log in to comment. ◂ PreviousOverviewNext ▸