Linuxfoundation
Linuxfoundation Nats-server: vulnerabilidades y CVE
Linuxfoundation Nats-server tiene 36 vulnerabilidades publicadas, 26 de ellas en los últimos 12 meses. 2 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE36
Últimos 12 meses26
Críticas2
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-58211 | Media (5.4) | 0.29% | — | 8 jul 2026 | NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, a client could be registered as the configured no_auth_user through a parser path used when… |
| CVE-2026-58208 | Alta (7.5) | 0.60% | — | 8 jul 2026 | NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, a WebSocket listener could route requests for the MQTT-over-WebSocket path into MQTT… |
| CVE-2026-58207 | Media (6.5) | 0.56% | — | 8 jul 2026 | NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, a client able to send account-scoped connection monitoring requests could crash the server… |
| CVE-2026-58254 | Media (5.3) | 0.31% | — | 8 jul 2026 | NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.8, message trace destination checks were applied to ordinary client connections but not… |
| CVE-2026-58253 | Alta (8.8) | 0.37% | — | 8 jul 2026 | NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, when no_auth_user was configured, a parser fast path intended for ordinary client… |
| CVE-2026-58252 | Media (6.5) | 0.46% | — | 8 jul 2026 | NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, an authenticated user could receive messages on denied subjects when a wildcard… |
| CVE-2026-58251 | Media (6.5) | 0.46% | — | 8 jul 2026 | NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, an authenticated user with subscription deny permissions could bypass a plain… |
| CVE-2026-58250 | Alta (7.5) | 0.74% | — | 8 jul 2026 | NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.12.8 and 2.11.17, an unauthenticated peer with network access to a leafnode listener with compression enabled… |
| CVE-2026-58214 | Media (4.3) | 0.35% | — | 8 jul 2026 | NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, an authenticated MQTT client could subscribe to the internal $MQTT.deliver.pubrel subject… |
| CVE-2026-58213 | Alta (7.1) | 0.44% | — | 8 jul 2026 | NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.1 and 2.12.9, an MQTT client could include protocol control characters in subscription filters that were… |
| CVE-2026-58210 | Alta (7.5) | 0.74% | — | 8 jul 2026 | NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, an unauthenticated MQTT client could cause the server to retain large incomplete MQTT… |
| CVE-2026-58209 | Media (4.3) | 0.34% | — | 8 jul 2026 | NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, MQTT retained message delivery and QoS1+ durable replay could deliver messages whose… |
| CVE-2026-33249 | Media (4.3) | 0.26% | — | 25 mar 2026 | NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.11.0 and prior to versions 2.11.15 and 2.12.6, a valid client which uses message tracing headers can… |
| CVE-2026-33248 | Media (4.2) | 0.17% | — | 25 mar 2026 | NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, when using mTLS for client identity, with `verify_and_map` to derive a NATS identity… |
| CVE-2026-33223 | Media (5.4) | 0.24% | — | 25 mar 2026 | NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, the NATS message header `Nats-Request-Info:` is supposed to be a guarantee of… |
| CVE-2026-33222 | Media (4.9) | 0.34% | — | 25 mar 2026 | NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, users with JetStream admin API access to restore one stream could restore to other… |
| CVE-2026-33247 | Media (5.3) | 0.54% | — | 25 mar 2026 | NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, if a nats-server is run with static credentials for all clients provided via argv… |
| CVE-2026-33246 | Media (5.4) | 0.24% | — | 25 mar 2026 | NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server offers a `Nats-Request-Info:` message header, providing information about a request. This is supposed to… |
| CVE-2026-33219 | Media (5.3) | 1.0% | — | 25 mar 2026 | NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a malicious client which can connect to the WebSockets port can cause unbounded… |
| CVE-2026-33218 | Alta (7.5) | 0.84% | — | 25 mar 2026 | NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a client which can connect to the leafnode port can crash the nats-server with a… |
| CVE-2026-33217 | Media (6.5) | 0.37% | — | 25 mar 2026 | NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, when using ACLs on message subjects, these ACLs were not applied in the `$MQTT.>`… |
| CVE-2026-33216 | Alta (7.5) | 0.63% | — | 25 mar 2026 | NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, for MQTT deployments using usercodes/passwords: MQTT passwords are incorrectly… |
| CVE-2026-29785 | Alta (7.5) | 0.97% | — | 25 mar 2026 | NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.14 and 2.12.5, if the nats-server has the "leafnode" configuration enabled (not default), then… |
| CVE-2026-27889 | Alta (7.5) | 0.84% | — | 25 mar 2026 | NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.2.0 and prior to versions 2.11.14 and 2.12.5, a missing sanity check on a WebSockets frame could… |
| CVE-2026-33215 | Media (6.5) | 0.28% | — | 24 mar 2026 | NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server provides an MQTT client interface. Prior to versions 2.11.15 and 2.12.5, Sessions and Messages can by… |
| CVE-2026-27571 | Alta (7.5) | 0.73% | — | 24 feb 2026 | NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The WebSockets handling of NATS messages handles compressed messages via the WebSockets negotiated compression. Prior to… |
| CVE-2023-46129 | Alta (7.5) | 0.37% | — | 31 oct 2023 | NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The cryptographic key handling library, nkeys, recently gained support… |
| CVE-2023-47090 | Media (6.5) | 0.66% | — | 30 oct 2023 | NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user in an authorization block can sometimes be used for unauthenticated access, even when the intention of the… |
| CVE-2022-28357 | Crítica (9.8) | 1.2% | — | 19 sept 2023 | NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended path to a management action from a management account. |
| CVE-2022-26652 | Media (6.5) | 2.3% | — | 10 mar 2022 | NATS nats-server before 2.7.4 allows Directory Traversal (with write access) via an element in a ZIP archive for JetStream streams. nats-streaming-server before 0.24.3 is also affected. |