AZL-78372 CVE-2026-27571 affecting package telegraf for versions less than 1.29.4-21

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The WebSockets handling of NATS messages handles compressed messages via the WebSockets negotiated compression. Prior to versions 2.11.2 and 2.12.3, the implementation bound the memory size of a NATS...

CVE-2026-27571

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The WebSockets handling of NATS messages handles compressed messages via the WebSockets negotiated compression. Prior to versions 2.11.2 and 2.12.3, the implementation bound the memory size of a NATS...

nats-server websockets are vulnerable to pre-auth memory DoS

Impact The WebSockets handling of NATS messages handles compressed messages via the WebSockets negotiated compression. The implementation bound the memory size of a NATS message but did not independently bound the memory consumption of the memory stream when constructing a NATS message which migh...

Allocation of Resources Without Limits or Throttling

Overview github.com/nats-io/nats-server/v2/server is an A simple, secure and performant communications system for digital systems, services and devices. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the WebSockets handling of NATS...

GHSA-QRVQ-68C2-7GRW nats-server websockets are vulnerable to pre-auth memory DoS

Impact The WebSockets handling of NATS messages handles compressed messages via the WebSockets negotiated compression. The implementation bound the memory size of a NATS message but did not independently bound the memory consumption of the memory stream when constructing a NATS message which migh...

CVE-2026-27571 nats-server websockets are vulnerable to pre-auth memory DoS

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The WebSockets handling of NATS messages handles compressed messages via the WebSockets negotiated compression. Prior to versions 2.11.2 and 2.12.3, the implementation bound the memory size of a NATS...

CVE-2026-27571

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The WebSockets handling of NATS messages handles compressed messages via the WebSockets negotiated compression. Prior to versions 2.11.2 and 2.12.3, the implementation bound the memory size of a NATS...

CVE-2026-27571 nats-server websockets are vulnerable to pre-auth memory DoS

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The WebSockets handling of NATS messages handles compressed messages via the WebSockets negotiated compression. Prior to versions 2.11.2 and 2.12.3, the implementation bound the memory size of a NATS...

CVE-2026-27571

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The WebSockets handling of NATS messages handles compressed messages via the WebSockets negotiated compression. Prior to versions 2.11.2 and 2.12.3, the implementation bound the memory size of a NATS...

CVE-2026-27571 nats-server websockets are vulnerable to pre-auth memory DoS

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The WebSockets handling of NATS messages handles compressed messages via the WebSockets negotiated compression. Prior to versions 2.11.2 and 2.12.3, the implementation bound the memory size of a NATS...

CVE-2026-27571

NATS-Server WebSockets handling is vulnerable to a pre-auth memory DoS via a compression bomb. Prior to v2.11.2 and v2.12.3, memory bounds for a NATS message were not independently applied to the memory stream, allowing excessive memory consumption and potential OS termination. The issue is explo...

CVE-2026-27571: Improper Handling of Highly Compressed Data (Data Amplification)

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The WebSockets handling of NATS messages handles compressed messages via the WebSockets negotiated compression. Prior to versions 2.11.2 and 2.12.3, the implementation bound the memory size of a NATS...

PT-2026-27616

Name of the Vulnerable Software and Affected Versions NATS-Server versions prior to 2.11.15 NATS-Server versions prior to 2.12.6 Description NATS-Server, a high-performance server for NATS.io, is affected by an issue where a malicious client connecting to the WebSockets port can cause unbounded...

Nats-Server 安全漏洞

Nats-Server is a high-performance server developed by Nats Open Source, used for native message delivery systems on Nats.io, cloud, and edge environments. There were security vulnerabilities in versions of NATS-Server prior to 2.11.2 and 2.12.3. These vulnerabilities stemmed from WebSockets’...

CVE-2025-61726 vulnerabilities

Vulnerabilities for packages: podinfo, aws-sigv4-proxy, opensearch-k8s-operator, hubble-ui, hubble, secrets-store-csi-driver, undock, aws-signer-notation-plugin, pvc-autoresizer, wuzz, dynamic-localpv-provisioner, neuvector-sigstore-interface, yace, kapp, wgcf, traefik, rancher-loglevel,...

GHSA-GR56-3GP6-6GMJ vulnerabilities

Vulnerabilities for packages: podinfo, aws-sigv4-proxy, opensearch-k8s-operator, hubble-ui, hubble, secrets-store-csi-driver, undock, aws-signer-notation-plugin, pvc-autoresizer, wuzz, esbuild, dynamic-localpv-provisioner, neuvector-sigstore-interface, yace, kapp, wgcf, traefik, rancher-loglevel,...

GHSA-XVQR-69V8-F3GV vulnerabilities

Vulnerabilities for packages: opensearch-k8s-operator, secrets-store-csi-driver, undock, rancher-loglevel, harbor-registry, langfuse, crossplane-provider-aws-kinesis, restic, ferretdb, go-jsonnet, hydra, gptscript, kube-bench, git-credential-oauth, spire-server, opencost, metacontroller, kratos,...

GHSA-CM6P-QC7V-M3JW vulnerabilities

Vulnerabilities for packages: opensearch-k8s-operator, secrets-store-csi-driver, undock, rancher-loglevel, harbor-registry, langfuse, crossplane-provider-aws-kinesis, restic, ferretdb, go-jsonnet, hydra, gptscript, kube-bench, git-credential-oauth, spire-server, opencost, metacontroller, kratos,...

GHSA-GM9R-Q53W-2GH4 vulnerabilities

Vulnerabilities for packages: podinfo, aws-sigv4-proxy, opensearch-k8s-operator, hubble-ui, hubble, secrets-store-csi-driver, undock, aws-signer-notation-plugin, pvc-autoresizer, wuzz, dynamic-localpv-provisioner, neuvector-sigstore-interface, yace, kapp, wgcf, traefik, rancher-loglevel,...

CVE-2025-61730 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-external-provisioner-fips, logstash-exporter-fips, keda, kubernetes-dashboard, dask-gateway, dockerize, wavefront-collector-for-kubernetes, blob-csi, aws-signer-notation-plugin-fips, net-kourier-fips, maru, kor, cilium-cli, kine, knative-operator,...