NatJack Attacks Hijack TCP Sessions and Spoof DNS via NAT Table Manipulation

Security researcher Malcolm Stagg has unveiled a new attack class dubbed NatJack that weaponizes network address translation (NAT) connection state to hijack active TCP sessions, spoof DNS responses, expose mapped ports, and exhaust NAT connection tables. Presented at Black Hat USA 2026, the research was conducted independently through the SODIUM-24 project and tested against dozens of real-world network infrastructure products from multiple vendors. The findings reveal that affected behavior was observed across independently developed implementations, including Windows and Linux, exposing a fundamental weakness in the assumption that hosts behind the same NAT will not manipulate one another's connection state. An attacker with privileged access to a system sharing the same NAT as the victim can, depending on the implementation, tamper with connection-tracking entries belonging to another internal host.

The research outlines four primary attack paths. One technique redirects traffic from an active TCP connection by replacing its NAT mapping. Another interferes with a victim's DNS request in a way that causes the legitimate DNS response to reach the attacker, enabling a forged reply to be returned to the client. Additional methods disclose externally mapped ports or flood the NAT connection table with spoofed flows until legitimate clients can no longer establish new connections. Two implementation-specific flaws have been assigned CVEs: CVE-2026-56181 (CVSS 8.3) in the Windows NAT component used by Hyper-V, described as an origin-validation error enabling spoofing from an adjacent network, and CVE-2026-63913 (CVSS 8.2) in Linux Netfilter conntrack, where a crafted SYN followed by a reset packet carrying an invalid sequence number prematurely forces an active NAT entry into a closed state due to a missing direction validation.

For Linux users, fixed stable kernel releases include 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, and 7.1. Stagg notes that the kernel patch corrects the specific code flaw but only mitigates the broader downstream-spoofing technique, complicating attacks rather than eliminating them. Because there is no single fix for the broader attack class, mitigation guidance emphasizes architectural separation of untrusted workloads from trusted systems sharing NAT infrastructure, applying available vendor updates, enforcing traffic encryption across internal networks, and deploying IP Source Guard where applicable. Defenders can audit their exposure by running a DNS leak test to verify resolver integrity, using a port scanner to identify unexpectedly mapped services, and checking internal services with an SSL/TLS checker to ensure session traffic cannot be trivially intercepted. As of August 7, 2026, there is no public evidence that NatJack techniques have been exploited in the wild, though the research underscores the growing need to treat shared NAT boundaries as untrusted attack surfaces.