NatJack Flaws in Windows, Linux, and macOS Enable NAT Connection Hijacking

Multi-year research into Network Address Translation (NAT) implementations across major operating systems has uncovered “NatJack,” a structural class of vulnerabilities that allows attackers to hijack active TCP streams, poison DNS caches, and exhaust device translation tables. Detailed by Synack Red Team researcher Malcolm Stagg, the research demonstrates that independently developed NAT stacks in Microsoft Windows, Linux, and Apple macOS share fundamental flaws in how they validate and isolate translated network state.

The core issue stems from implicit trust assumptions built into network address translation mechanisms. To date, two CVE identifiers have been formally assigned to address components of this vulnerability class: CVE-2026-56181, which affects Microsoft Windows NAT within Hyper-V virtual networking, and CVE-2026-63913, which targets the Linux netfilter conntrack subsystem.

How NAT State Tracking Breaks Down

Stateful Network Address Translation relies on an internal lookup table—such as the conntrack table in Linux or the virtual switch translation engine in Hyper-V—to map internal, private IP addresses and ephemeral ports to a shared external public interface. When an internal host sends an outbound IP packet, the NAT gateway rewrites the source address and port, creates a state entry tracking the connection tuple (source IP, source port, destination IP, destination port, protocol), and routes the packet onward.

The NatJack vulnerability class exploits flaws in how these mapping tables handle state transitions and incoming untrusted traffic. Because stateful tracking engines must continuously process incoming packets from external networks to match them against open internal requests, weak validation allows remote untrusted hosts to craft packets that manipulate existing mapping entries. When NAT state engines fail to enforce strict sequence validation, fail to isolate adjacent translation bindings, or accept out-of-order state updates from untrusted external interfaces, attackers can manipulate state lookup tables directly.

NatJack Attack Vectors and Mechanics

Stagg’s research identified four primary attack techniques that can be executed against vulnerable NAT implementations:

• Active TCP Connection Hijacking: By sending specially constructed packets to the external NAT interface, an attacker can manipulate established TCP connection states. This allows the attacker to inject arbitrary data into active streams passing through the gateway or send forced TCP reset packets (RST) to tear down legitimate sessions.
• DNS Response Poisoning: Outbound UDP requests—such as DNS lookups—rely on ephemeral port allocation within the NAT mapping table. By probing or forcing collisions in the translation engine, an attacker can predict or identify the assigned external mapping for an active DNS query, enabling them to race the legitimate DNS server and inject spoofed resolution responses back to the internal client.
• Port Mapping Discovery: Attackers can systematically probe the NAT gateway to identify active ephemeral ports assigned to other internal hosts. This side-channel leakage exposes active internal connections and network activity without requiring direct visibility inside the private network segment.
• NAT Table Exhaustion (Denial of Service): NAT mapping tables have finite memory allocations. By exploiting handling flaws in how incomplete or unvalidated connections are held in state memory, an attacker can rapidly flood the translation engine with persistent, phantom mappings, causing a complete denial-of-service condition that prevents all hosts behind the NAT gateway from establishing new outbound or inbound connections.

Affected Systems and Realistic Blast Radius

Because NAT is a foundational networking building block, the blast radius of NatJack extends across cloud environments, enterprise virtualized workloads, container orchestration setups, and local perimeter routers:

• Windows Virtualization (CVE-2026-56181): Environments relying on Hyper-V virtual switches and container networking utilize Windows NAT for guest-to-host and guest-to-external communication. A compromised guest VM or external network attacker could exploit CVE-2026-56181 to intercept or disrupt traffic belonging to adjacent hypervisor workloads.
• Linux Infrastructure (CVE-2026-63913): The Linux netfilter conntrack subsystem underpins enterprise Linux firewalls, edge routers, and Kubernetes node networking (such as kube-proxy in iptables/IPVS mode). Exploitation of conntrack state tracking allows attackers to break tenant isolation on shared Kubernetes nodes or hijack traffic traversing edge gateways.
• macOS Host Networking: Workstations using macOS Internet Sharing, local hypervisors, or developer container environments rely on Apple’s native NAT implementation, exposing local developer networks to connection tampering or side-channel port enumeration.

Remediation and Defensive Measures

Mitigating the NatJack vulnerability class requires updating underlying core operating system kernels and network translation drivers:

• Windows Systems: Ensure hypervisors and Windows hosts running Hyper-V containers receive the latest kernel and virtual networking updates addressing CVE-2026-56181.
• Linux Workloads: Apply distribution patches for the kernel netfilter stack to resolve CVE-2026-63913. On high-throughput Linux gateways, verify that strict TCP state checking is enabled by ensuring net.netfilter.nf_conntrack_tcp_loose is set to 0 in sysctl.conf.
• Transport Protocol Security: Implement DNS-over-HTTPS (DoH) or DNSSEC validation to mitigate the risk of DNS response poisoning via UDP NAT state manipulation.
• Monitoring: Configure network logging and infrastructure alerts to monitor conntrack table utilization (conntrack -C on Linux) to detect anomalous spikes in state table creation indicative of NAT table exhaustion attacks.