CVE-2026-33219 vulnerabilities

Vulnerabilities for packages: k3s, prometheus-nats-exporter, prometheus-nats-exporter-fips, kine, nats-top-fips, nats, nats-fips, rke2-runtime-fips, rke2-runtime, nats-top, milvus, telegraf...

CVE-2026-33222 vulnerabilities

Vulnerabilities for packages: k3s, prometheus-nats-exporter, prometheus-nats-exporter-fips, kine, nats-top-fips, nats, nats-fips, rke2-runtime-fips, rke2-runtime, nats-top, milvus, telegraf...

CVE-2026-33248 vulnerabilities

Vulnerabilities for packages: k3s, prometheus-nats-exporter, prometheus-nats-exporter-fips, kine, nats-top-fips, nats, nats-fips, rke2-runtime-fips, rke2-runtime, nats-top, milvus, telegraf...

CVE-2026-33249 vulnerabilities

Vulnerabilities for packages: k3s, prometheus-nats-exporter, prometheus-nats-exporter-fips, kine, nats-top-fips, nats, nats-fips, rke2-runtime-fips, rke2-runtime, nats-top, milvus, telegraf...

CVE-2026-29785 vulnerabilities

Vulnerabilities for packages: k3s, prometheus-nats-exporter, prometheus-nats-exporter-fips, kine, nats-top-fips, nats, nats-fips, rke2-runtime-fips, rke2-runtime, nats-top, milvus, telegraf...

GHSA-52JH-2XXH-PWH6 vulnerabilities

Vulnerabilities for packages: k3s, prometheus-nats-exporter, prometheus-nats-exporter-fips, kine, nats-top-fips, nats, nats-fips, rke2-runtime-fips, rke2-runtime, nats-top, milvus, telegraf...

GHSA-PQ2Q-RCW4-3HR6 NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead

Background NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. When using WebSockets, a malicious client can trigger a server crash with crafted frames, before authentication. Problem Description A missi...

Integer Overflow or Wraparound

Overview github.com/nats-io/nats-server/server is an A simple, secure and performant communications system for digital systems, services and devices. Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the wsRead function. An attacker can cause the server proces...

NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead

Background NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. When using WebSockets, a malicious client can trigger a server crash with crafted frames, before authentication. Problem Description A missi...

Nats-Server 授权问题漏洞

Nats-Server is a high-performance server developed by Nats for use in Nats.io, cloud, and edge native messaging systems. Versions of NATS-Server prior to 2.11.15 and 2.12.6 contained an authorization vulnerability. This vulnerability stemmed from improper access control in the JetStream managemen...

CVE-2026-33216: Plaintext Storage of a Password

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, for MQTT deployments using usercodes/passwords: MQTT passwords are incorrectly classified as a non-authenticating identity statement JWT and exposed via monitoring...

CVE-2026-33222: Improper Authorization

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, users with JetStream admin API access to restore one stream could restore to other stream names, impacting data which should have been protected against them...

CVE-2026-33249: Incorrect Authorization

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.11.0 and prior to versions 2.11.15 and 2.12.6, a valid client which uses message tracing headers can indicate that the trace messages can be sent to an arbitrary valid subject,...

Linux Distros Unpatched Vulnerability : CVE-2026-33215

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats- server provides an MQTT client interface. Prior to...

Nats-Server 安全漏洞

Nats-Server is a high-performance server developed by Nats Open Source, used in Nats.io, cloud, and edge native messaging systems. There were security vulnerabilities in versions of Nats-Server before 2.11.15 and 2.12.6. These vulnerabilities stemmed from the incorrect classification of MQTT...

CVE-2026-27889: Integer Overflow or Wraparound

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.2.0 and prior to versions 2.11.14 and 2.12.5, a missing sanity check on a WebSockets frame could trigger a server panic in the nats-server. This happens before authentication, and...

CVE-2026-33246: Improper Authentication

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server offers a Nats-Request-Info: message header, providing information about a request. This is supposed to provide enough information to allow for account/user identification, such that NAT...

Nats-Server 信任管理问题漏洞

Nats-Server is a high-performance server developed by Nats Open Source, used in Nats.io, cloud, and edge native messaging systems. Versions of Nats-Server prior to 2.11.15 and 2.12.6 contained a trust management vulnerability. This vulnerability stemmed from incorrect enforcement of certain RDN...

Nats-Server 安全漏洞

Nats-Server is a high-performance server developed by Nats Open Source, used in Nats.io, cloud, and edge native messaging systems. There were security vulnerabilities in versions prior to 2.11.15 and 2.12.6 of Nats-Server. These vulnerabilities stemmed from incomplete stripping of the...

Nats-Server 安全漏洞

Nats-Server is a high-performance server developed by Nats Open Source, used in Nats.io, cloud, and edge native messaging systems. There were security vulnerabilities in versions prior to 2.11.15 and 2.12.6 of Nats-Server. These vulnerabilities allowed malicious clients to exploit unlimited memor...