nats-server vulnerabilities (Ubuntu)
29 vulnerabilities.
-
nats-serverUbuntu NATS Server: MQTT-over-WebSocket Path Can Crash WebSocket-Only JetStream Servers Before MQTT Is Enabled 6.8 Medium -
nats-serverUbuntu NATS Server: `no_auth_user` pre-CONNECT fast path bypasses user connection restrictions 5.4 Medium -
nats-serverUbuntu Further research determined the issue is not a vulnerability based on CNA Rule 4.1.12 The act of updating Product dependencies MUST NOT be determined to be a Vulnerability, regardless of whether the d… No score -
nats-serverUbuntu NATS Server: Remote crash via integer overflow in Connz pagination 7.7 High -
nats-serverUbuntu NATS Server: MQTT partial CONNECT packets can exhaust pre-auth memory 7.5 High -
nats-serverUbuntu NATS Server: MQTT retained and QoS replay bypass subscribe deny filters 4.3 Medium -
nats-serverUbuntu NATS Server: MQTT subscribe ACL bypass via $MQTT.deliver.pubrel prefix (incomplete fix for CVE-2026-33217) 4.3 Medium -
nats-serverUbuntu NATS Server: Incomplete fix for CVE-2026-33249: Leaf node connections bypass Nats-Trace-Dest permission check 5.3 Medium -
nats-serverUbuntu NATS Server: MQTT SUBSCRIBE Protocol Injection via Leaf Node/Route Forwarding allows arbitrary NATS command injection 7.1 High -
nats-serverUbuntu NATS Server: Pre-auth server crash via double INFO in leafnode handshake 7.5 High -
nats-serverUbuntu NATS Server: Subscribe Authz Bypass via Wildcard-Overlap 6.5 Medium -
nats-serverUbuntu NATS Server: Route API Auth Bypass 8.8 High -
nats-serverUbuntu NATS Server: Queue Subscribe Authz Bypass 6.5 Medium -
nats-serverUbuntu NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead 7.5 High -
nats-serverUbuntu NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching 4.2 Medium -
nats-serverUbuntu NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers 6.4 Medium -
nats-serverUbuntu NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing 6.4 Medium -
nats-serverUbuntu NATS JetStream has an authorization bypass through its Management API 4.9 Medium -
nats-serverUbuntu NATS is vulnerable to pre-auth DoS through WebSockets client service 5.3 Medium -
nats-serverUbuntu NATS has pre-auth server panic via leafnode handling 7.5 High -
nats-serverUbuntu NATS allows MQTT clients to bypass ACL checks 7.1 High -
nats-serverUbuntu NATS has MQTT plaintext password disclosure 8.6 High -
nats-serverUbuntu NATS Server panic via malicious compression on leafnode port 7.5 High -
nats-serverUbuntu NATS is vulnerable to MQTT hijacking via Client ID 6.5 Medium -
nats-serverUbuntu NATS credentials are exposed in monitoring port via command-line argv 7.4 High -
nats-serverUbuntu NATS: Message tracing can be redirected to arbitrary subject 4.3 Medium -
nats-serverUbuntu nats-server websockets are vulnerable to pre-auth memory DoS 5.9 Medium -
nats-serverUbuntu NATS-Server Fails to Authorize Certain Jetstream Admin APIs 9.6 Critical -
nats-serverUbuntu NATS nats-server allows directory traversal via unintended path to a management action 9.8 Critical