CVE-2020-28466

🗓️ 07 Mar 2021 09:55:16Reported by snykType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 56 Views

CVE-2020-28466 affects all versions of github.com/nats-io/nats-server/server. Untrusted accounts can crash the server using configs representing service export/import cycles. NATS maintainers advise heightened caution with untrusted users, prompt fixes for severe remote execution or denial-of-service flaws, and regular building from git for such services to mitigate the risk

Reporter	Title	Published	Views	Family All 19
Circl	CVE-2020-28466	7 Mar 202112:49	–	circl
CNNVD	Waldemar Quevedo nats-server 安全漏洞	7 Mar 202100:00	–	cnnvd
Cvelist	CVE-2020-28466 Denial of Service (DoS)	7 Mar 202109:55	–	cvelist
Debian CVE	CVE-2020-28466	7 Mar 202109:55	–	debiancve
EUVD	EUVD-2022-1089	3 Oct 202520:07	–	euvd
Github Security Blog	Import loops in account imports, nats-server DoS	21 May 202116:22	–	github
Github Security Blog	Denial of service in github.com/nats-io/nats-server/server	15 Feb 202201:57	–	github
NVD	CVE-2020-28466	7 Mar 202110:15	–	nvd
OSV	BIT-NATS-2020-28466 Denial of Service (DoS)	6 Mar 202410:58	–	osv
OSV	CGA-4PXP-V4QJ-CJFP	6 Jun 202412:23	–	osv

NVD

Node

linuxfoundation nats-serverRange2.0.0–2.2.0

[
  {
    "product": "github.com/nats-io/nats-server/server",
    "vendor": "n/a",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
openwall	www.openwall.com/lists/oss-security/2021/03/16/1
github	www.github.com/nats-io/nats-server/pull/1731
openwall	www.openwall.com/lists/oss-security/2021/03/16/2
snyk	www.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMNATSIONATSSERVERSERVER-1042967

30 Mar 2026 14:30Current

7.5High risk

Vulners AI Score7.5

CVSS 25

CVSS 3.17.5

EPSS0.08427