github.com/nats-io/nats-server/v2 vulnerabilities (Go)
28 vulnerabilities.
-
github.com/nats-io/nats-server/v2Go NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead 7.5 High -
github.com/nats-io/nats-server/v2Go NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching 4.2 Medium -
github.com/nats-io/nats-server/v2Go NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers 6.4 Medium -
github.com/nats-io/nats-server/v2Go NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing 6.4 Medium -
github.com/nats-io/nats-server/v2Go NATS JetStream has an authorization bypass through its Management API 4.9 Medium -
github.com/nats-io/nats-server/v2Go NATS is vulnerable to pre-auth DoS through WebSockets client service 5.3 Medium -
github.com/nats-io/nats-server/v2Go NATS has pre-auth server panic via leafnode handling 7.5 High -
github.com/nats-io/nats-server/v2Go NATS allows MQTT clients to bypass ACL checks 7.1 High -
github.com/nats-io/nats-server/v2Go NATS has MQTT plaintext password disclosure 8.6 High -
github.com/nats-io/nats-server/v2Go NATS Server panic via malicious compression on leafnode port 7.5 High -
github.com/nats-io/nats-server/v2Go NATS is vulnerable to MQTT hijacking via Client ID 6.5 Medium -
github.com/nats-io/nats-server/v2Go NATS credentials are exposed in monitoring port via command-line argv 7.4 High -
github.com/nats-io/nats-server/v2Go NATS: Message tracing can be redirected to arbitrary subject 4.3 Medium -
github.com/nats-io/nats-server/v2Go nats-server websockets are vulnerable to pre-auth memory DoS 5.9 Medium -
github.com/nats-io/nats-server/v2Go NATS-Server Fails to Authorize Certain Jetstream Admin APIs 9.6 Critical -
github.com/nats-io/nats-server/v2Go NATS Server and Streaming Server fails to enforce negative user permissions, may allow denied subjects 6.3 Medium -
github.com/nats-io/nats-server/v2Go NATS server TLS missing ciphersuite settings when CLI flags used No score -
github.com/nats-io/nats-server/v2Go xkeys Seal encryption used fixed key for all encryption 7.5 High -
github.com/nats-io/nats-server/v2Go NATS.io: Adding accounts for just the system account adds auth bypass 6.5 Medium -
github.com/nats-io/nats-server/v2Go NATS nats-server allows directory traversal via unintended path to a management action 9.8 Critical -
github.com/nats-io/nats-server/v2Go Arbitrary file write in nats-server 6.5 Medium -
github.com/nats-io/nats-server/v2Go Incorrect Authorization in NATS nats-server 8.8 High -
github.com/nats-io/nats-server/v2Go Import loops in account imports, nats-server DoS 7.5 High -
github.com/nats-io/nats-server/v2Go nats-io/jwt not enforcing checking of Import token permissions 7.5 High -
github.com/nats-io/nats-server/v2Go Denial of Service (DoS) 7.5 High -
github.com/nats-io/nats-server/v2Go Incorrect handling of credential expiry by /nats-io/nats-server 9.8 Critical -
github.com/nats-io/nats-server/v2Go Nil dereference in NATS JWT, DoS of nats-server 7.5 High -
github.com/nats-io/nats-server/v2Go Integer Overflow or Wraparound in NATS Server 7.5 High