New NatJack Attacks Hijack TCP Sessions and Spoof DNS by Manipulating NAT Tables
A new attack class called NatJack has been disclosed by security researcher Malcolm Stagg. It manipulates network address translation (NAT) connection state to hijack active TCP sessions, spoof DNS responses, expose mapped ports, and exhaust NAT tables.
Intelligence analysis by Llama
NatJack requires privileged access to a system behind the same NAT as the victim. The mitigation guidance emphasizes separating untrusted workloads from trusted systems that share NAT infrastructure. There is no single patch for the broader attack class.
Imagine you're playing a game with your friends online. NatJack is a way for a bad guy to take control of your game and make it look like they're you. They can also make it look like they're getting messages from your friends, even if they're not really talking to them. This can be very bad and can make it hard for you to play the game or even get online at all.
Analysis
NatJack Overview
NatJack is a new attack class that manipulates network address translation (NAT) connection state to hijack active TCP sessions, spoof DNS responses, expose mapped ports, and exhaust NAT tables. The attack requires privileged access to a system behind the same NAT as the victim.
Mitigation Guidance
The mitigation guidance for NatJack emphasizes separating untrusted workloads from trusted systems that share NAT infrastructure. This can be achieved by implementing network segmentation and isolating untrusted workloads from trusted systems.
Impact on Network Security
The NatJack attack has significant implications for network security, as it can be used to hijack active TCP sessions, spoof DNS responses, and expose mapped ports. This can lead to a range of security issues, including data breaches and denial-of-service attacks.
Research and Development
The NatJack research was conducted independently by Stagg through SODIUM-24. The research targets an assumption built into many NAT implementations: hosts behind the same NAT are generally assumed not to manipulate one another's connection state. An attacker controlling a system behind the same NAT can, depending on the implementation, manipulate connection-tracking entries belonging to another system.
CVEs and Patches
Two implementation-specific flaws have been assigned CVEs: CVE-2026-56181 (CVSS score: 8.3) in Windows NAT used by Hyper-V, and CVE-2026-63913 (CVSS score: 8.2) in Linux Netfilter conntrack. NatJack generally requires the attacker to have privileged access to a system behind the same NAT as the victim. The mitigation guidance therefore emphasizes separating untrusted workloads from trusted systems that share NAT infrastructure. There is no single patch for the broader attack class. Organizations should apply available Windows and Linux updates and encrypt traffic even within internal networks. The research also recommends Internet Protocol (IP) Source Guard where applicable.
Key points
- NatJack is a new attack class that manipulates network address translation (NAT) connection state to hijack active TCP sessions, spoof DNS responses, expose mapped ports, and exhaust NAT tables.
- The attack requires privileged access to a system behind the same NAT as the victim.
- The mitigation guidance emphasizes separating untrusted workloads from trusted systems that share NAT infrastructure.
- There is no single patch for the broader attack class.
- Organizations should apply available Windows and Linux updates and encrypt traffic even within internal networks.
If organizations implement the recommended mitigation guidance, such as separating untrusted workloads from trusted systems that share NAT infrastructure, they can reduce the risk of a NatJack attack. Additionally, applying available Windows and Linux updates and encrypting traffic even within internal networks can also help to prevent NatJack attacks.
If organizations do not implement the recommended mitigation guidance, they may be vulnerable to NatJack attacks. This can lead to a range of security issues, including data breaches and denial-of-service attacks.
