GO-2026-4836 vulnerabilities

Vulnerabilities for packages: k3s, kine, nats, telegraf, nats-top...

GO-2026-4837 vulnerabilities

Vulnerabilities for packages: k3s, kine, nats, telegraf, nats-top...

GO-2025-3525 vulnerabilities

Vulnerabilities for packages: nats, opentelemetry-collector-contrib, amazon-cloudwatch-agent, tempo, splunk-otel-collector, grafana-alloy, k8sgpt, argo-workflows, kargo, opentelemetry-collector, argo-rollouts, kubeflow-pipelines...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: docker-credential-ecr-login, dockerize, cosign, falco-no-driver, kapp, cluster-api-ipam-provider-in-cluster, nginx-prometheus-exporter, src-fingerprint, headlamp, newrelic-infra-operator, sealed-secrets, minio, wgcf, govulncheck, aws-flb-kinesis, tofu-controller, sop...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: kapp, wgcf, nginx-prometheus-exporter, headlamp, flux, tekton-chains, k3s, terraform, controller-gen, opa, portieris, kubernetes-dashboard-api, yunikorn-k8shim, buildkitd, kyverno-notation-aws, wait-for-port, nri-haproxy, cloud-sql-proxy, src, falcoctl, ipfs-cluster,...

JLSEC-2026-1129

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, the NATS message header Nats-Request-Info: is supposed to be a guarantee of identity by the NATS server, but the stripping of this header from inbound messages was...

JLSEC-2026-1148

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.1 and 2.12.9, an MQTT client could include protocol control characters in subscription filters that were later forwarded as NATS protocol data to route or leafnode connections, corrupti...

CLEANSTART-2026-UB57333 Security fixes in nats-server-fips 2.10.4-r0

Package nats-server-fips version 2.10.4-r0 fixes 1 vulnerabilities: CVE-2023-46129...

CLEANSTART-2026-VW61605 Security fixes in nats-streaming 0.24.6-r3

Package nats-streaming version 0.24.6-r3 fixes 2 vulnerabilities: CVE-2026-39822, CVE-2026-42505...

CLEANSTART-2026-TN85726 Security fixes in nats-streaming 0.25.6-r4

Package nats-streaming version 0.25.6-r4 fixes 2 vulnerabilities: CVE-2026-39822, CVE-2026-42505...

CLEANSTART-2026-IF83515 Security fixes in nats-streaming 0.25.6-r3

Package nats-streaming version 0.25.6-r3 fixes 1 vulnerabilities: CVE-2026-42504...

CLEANSTART-2026-NU09450 Security fixes in nats-streaming 0.24.6-r2

Package nats-streaming version 0.24.6-r2 fixes 1 vulnerabilities: CVE-2026-42504...

CLEANSTART-2026-MZ40522 Security fixes for CVE-2026-39822, CVE-2026-42504, CVE-2026-42505 applied in versions: 0.22.1-r0, 0.24.6-r2

Multiple security vulnerabilities affect the nats-streaming package. These issues are resolved in later releases. See references for individual vulnerability details...

SUSE CVE-2026-58208

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, a WebSocket listener could route requests for the MQTT-over-WebSocket path into MQTT handling even when MQTT was not configured, allowing an unauthenticated client with...

SUSE CVE-2026-58250

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.12.8 and 2.11.17, an unauthenticated peer with network access to a leafnode listener with compression enabled could crash the server during the pre-authentication leafnode handshake by...

SUSE CVE-2026-58251

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, an authenticated user with subscription deny permissions could bypass a plain subject deny rule by using a queue subscription, because queue-specific deny...

SUSE CVE-2026-58252

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, an authenticated user could receive messages on denied subjects when a wildcard subscription overlapped with a configured wildcard deny rule but was not a subset...

SUSE CVE-2026-58253

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, when noauthuser was configured, a parser fast path intended for ordinary client connections could also apply to route or leafnode listeners, allowing an...

BIT-NATS-2026-58254 NATS Server: Incomplete fix for CVE-2026-33249: Leaf node connections bypass Nats-Trace-Dest permission check

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.8, message trace destination checks were applied to ordinary client connections but not consistently to messages arriving through leafnode connections, allowing a leafnode...

BIT-NATS-2026-58253 NATS Server: Route API Auth Bypass

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, when noauthuser was configured, a parser fast path intended for ordinary client connections could also apply to route or leafnode listeners, allowing an...