CVE-2026-27571

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The WebSockets handling of NATS messages handles compressed messages via the WebSockets negotiated compression. Prior to versions 2.11.2 and 2.12.3, the implementation bound the memory size of a NATS...

CVE-2026-27571 nats-server websockets are vulnerable to pre-auth memory DoS

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The WebSockets handling of NATS messages handles compressed messages via the WebSockets negotiated compression. Prior to versions 2.11.2 and 2.12.3, the implementation bound the memory size of a NATS...

Nats-Server 安全漏洞

Nats-Server is a high-performance server developed by Nats Open Source, used for native message delivery systems on Nats.io, cloud, and edge environments. There were security vulnerabilities in versions of NATS-Server prior to 2.11.2 and 2.12.3. These vulnerabilities stemmed from WebSockets’...

PT-2026-27616

Name of the Vulnerable Software and Affected Versions NATS-Server versions prior to 2.11.15 NATS-Server versions prior to 2.12.6 Description NATS-Server, a high-performance server for NATS.io, is affected by an issue where a malicious client connecting to the WebSockets port can cause unbounded...

GHSA-GM9R-Q53W-2GH4 vulnerabilities

Vulnerabilities for packages: git-credential-oauth, croc, hubble-ui, kube-arangodb, keda, kustomize, nfs-subdir-external-provisioner, opensearch-k8s-operator, yace, gcp-compute-persistent-disk-csi-driver, crossplane-provider-aws-sns, crossplane-provider-aws-lambda, sealed-secrets, sonobuoy,...

CVE-2025-61726 vulnerabilities

Vulnerabilities for packages: git-credential-oauth, croc, hubble-ui, kube-arangodb, keda, kustomize, nfs-subdir-external-provisioner, opensearch-k8s-operator, yace, gcp-compute-persistent-disk-csi-driver, crossplane-provider-aws-sns, crossplane-provider-aws-lambda, sealed-secrets, sonobuoy,...

GHSA-GR56-3GP6-6GMJ vulnerabilities

Vulnerabilities for packages: git-credential-oauth, croc, hubble-ui, http-echo, kube-arangodb, keda, kustomize, nfs-subdir-external-provisioner, opensearch-k8s-operator, yace, gcp-compute-persistent-disk-csi-driver, crossplane-provider-aws-sns, crossplane-provider-aws-lambda, nri-mongodb,...

GHSA-CM6P-QC7V-M3JW vulnerabilities

Vulnerabilities for packages: hubble-ui, yace, keda, crossplane-provider-aws-sns, sealed-secrets, litefs, rabbitmq-default-user-credential-updater, headlamp, k3s, secrets-store-csi-driver-provider-aws, pgpool2exporter, mountpoint-s3-csi-driver, extism, kube-vip-cloud-provider, redka, azure-ipam,...

GHSA-XVQR-69V8-F3GV vulnerabilities

Vulnerabilities for packages: hubble-ui, yace, keda, crossplane-provider-aws-sns, sealed-secrets, litefs, rabbitmq-default-user-credential-updater, headlamp, k3s, secrets-store-csi-driver-provider-aws, pgpool2exporter, mountpoint-s3-csi-driver, extism, kube-vip-cloud-provider, redka, azure-ipam,...

CVE-2025-61730 vulnerabilities

Vulnerabilities for packages: minc-fips, kubernetes-csi-livenessprobe, azure-service-operator-fips, zabbix-agent2, kyverno-policy-reporter-kyverno-plugin-fips, helm-operator-fips, crossplane-provider-aws-kinesis, reports-server, external-dns-fips, etcd-fips, prometheus-blackbox-exporter,...

GHSA-GR56-3GP6-6GMJ vulnerabilities

Vulnerabilities for packages: minc-fips, kubernetes-csi-livenessprobe, azure-service-operator-fips, zabbix-agent2, kyverno-policy-reporter-kyverno-plugin-fips, helm-operator-fips, crossplane-provider-aws-kinesis, reports-server, external-dns-fips, etcd-fips, prometheus-blackbox-exporter,...

GHSA-XVQR-69V8-F3GV vulnerabilities

Vulnerabilities for packages: minc-fips, kubernetes-csi-livenessprobe, azure-service-operator-fips, zabbix-agent2, kyverno-policy-reporter-kyverno-plugin-fips, helm-operator-fips, crossplane-provider-aws-kinesis, age-fips, metallb-fips, reports-server, external-dns-fips,...

GHSA-CM6P-QC7V-M3JW vulnerabilities

Vulnerabilities for packages: minc-fips, kubernetes-csi-livenessprobe, azure-service-operator-fips, zabbix-agent2, kyverno-policy-reporter-kyverno-plugin-fips, helm-operator-fips, crossplane-provider-aws-kinesis, age-fips, metallb-fips, reports-server, external-dns-fips,...

CVE-2025-61731 vulnerabilities

Vulnerabilities for packages: minc-fips, kubernetes-csi-livenessprobe, azure-service-operator-fips, zabbix-agent2, kyverno-policy-reporter-kyverno-plugin-fips, helm-operator-fips, crossplane-provider-aws-kinesis, age-fips, metallb-fips, reports-server, external-dns-fips,...

CVE-2025-68119 vulnerabilities

Vulnerabilities for packages: minc-fips, kubernetes-csi-livenessprobe, azure-service-operator-fips, zabbix-agent2, kyverno-policy-reporter-kyverno-plugin-fips, helm-operator-fips, crossplane-provider-aws-kinesis, age-fips, metallb-fips, reports-server, external-dns-fips,...

CVE-2025-61726 vulnerabilities

Vulnerabilities for packages: minc-fips, kubernetes-csi-livenessprobe, azure-service-operator-fips, zabbix-agent2, kyverno-policy-reporter-kyverno-plugin-fips, helm-operator-fips, crossplane-provider-aws-kinesis, reports-server, external-dns-fips, etcd-fips, prometheus-blackbox-exporter,...

PT-2026-21766

Name of the Vulnerable Software and Affected Versions NATS-Server versions prior to 2.11.2 NATS-Server versions prior to 2.12.3 Description NATS-Server, a high-performance messaging system, has an issue in its WebSocket implementation. The server handles compressed messages via WebSocket negotiat...

CVE-2025-61729 vulnerabilities

Vulnerabilities for packages: opentelemetry-operator, tekton-chains, kubernetes-csi-livenessprobe, azure-service-operator-fips, nats-fips, helm-operator-fips, kserve, age-fips, newrelic-infrastructure-agent-fips, opa-fips-envoy, github-mcp-server, external-dns-fips, etcd-fips, chart-testing-fips,...

GHSA-7C64-F9JR-V9H2 vulnerabilities

Vulnerabilities for packages: opentelemetry-operator, tekton-chains, kubernetes-csi-livenessprobe, azure-service-operator-fips, nats-fips, helm-operator-fips, kserve, age-fips, newrelic-infrastructure-agent-fips, opa-fips-envoy, github-mcp-server, external-dns-fips, etcd-fips, chart-testing-fips,...

CVE-2025-61729 vulnerabilities

Vulnerabilities for packages: hubble-ui, aws-load-balancer-controller, keda, dgraph, sealed-secrets, kafkaexporter, opentelemetry-collector, promxy, rabbitmq-default-user-credential-updater, headlamp, newrelic-k8s-metadata-injection, pulumi-language-yaml, k3s, kserve, github-mcp-server,...