CVE-2020-28466

🗓️ 07 Mar 2021 10:15:12Reported by [email protected]Type

CVE-2020-28466 affects all versions of github.com/nats-io/nats-server/server package, allowing untrusted accounts to crash the server using certain configurations. Running NATS service exposed to untrusted users poses heightened risk. Prompt releases are assured for any remote execution flaw or denial-of-service by unauthenticated users. Fixes for denial of service issues may only be committed to the main development branch with no special attention

Reporter	Title	Published	Views	Family All 20
BDU FSTEC	The vulnerability of the NATS messaging system server, related to uncontrolled resource consumption, allows attackers to cause service failures.	30 Mar 202100:00	–	bdu_fstec
Circl	CVE-2020-28466	7 Mar 202112:49	–	circl
CNNVD	Waldemar Quevedo nats-server 安全漏洞	7 Mar 202100:00	–	cnnvd
CVE	CVE-2020-28466	7 Mar 202109:55	–	cve
Cvelist	CVE-2020-28466 Denial of Service (DoS)	7 Mar 202109:55	–	cvelist
Debian CVE	CVE-2020-28466	7 Mar 202109:55	–	debiancve
EUVD	EUVD-2022-1089	3 Oct 202520:07	–	euvd
Github Security Blog	Import loops in account imports, nats-server DoS	21 May 202116:22	–	github
Github Security Blog	Denial of service in github.com/nats-io/nats-server/server	15 Feb 202201:57	–	github
OSV	BIT-NATS-2020-28466 Denial of Service (DoS)	6 Mar 202410:58	–	osv

NVD

Node

linuxfoundation nats-serverRange2.0.0–2.2.0

Source	Link
snyk	www.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMNATSIONATSSERVERSERVER-1042967
openwall	www.openwall.com/lists/oss-security/2021/03/16/2
openwall	www.openwall.com/lists/oss-security/2021/03/16/1
github	www.github.com/nats-io/nats-server/pull/1731

17 Jun 2026 03:10Current

CVSS 25

CVSS 3.17.5

EPSS0.03658