https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T12:40:58.003700+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-nats-2023-46129 BIT-nats-2023-46129 — xkeys Seal encryption used fixed key for all encryption 2026-10-03T12:40:58.119423+00:00

Affected: Bitnami: nats

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The cryptographic key handling library, nkeys, recently gained support for encryption, not just for signing/authentication. This is used in nats-server 2.10 (Sep 2023) and newer for authentication callouts. In nkeys versions 0.4.0 through 0.4.5, corresponding with NATS server versions 2.10.0 through 2.10.3, the nkeys library's `xkeys` encryption handling logic mistakenly passed an array by value into an internal function, where the function mutated that buffer to populate the encryption key to use. As a result, all encryption was actually to an all-zeros key. This affects encryption only, not signing. FIXME: FILL IN IMPACT ON NATS-SERVER AUTH CALLOUT SECURITY. nkeys Go library 0.4.6, corresponding with NATS Server 2.10.4, has a patch for this issue. No known workarounds are available. For any application handling auth callouts in Go, if using the nkeys library, update the dependency, recompile and deploy that in lockstep.

 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0756 certfr-2025-avi-0756 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer… 2026-10-03T12:40:58.119485+00:00 certfr-2025-avi-0756 https://cve.radiocsirt.org/vuln/cleanstart-2026-ji58569 CLEANSTART-2026-JI58569 — Security fix for CVE-2023-46129 applied in: nats-server-fips 2.10.4-r0 2026-10-03T12:40:58.119506+00:00

Affected: CleanStart: nats-server-fips

Security vulnerability affects the nats-server-fips package. This issue is resolved in later releases. See references for vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-219599 EUVD-2026-219599 2026-10-03T12:40:58.119527+00:00 EUVD-2026-219599 https://cve.radiocsirt.org/vuln/fkie_cve-2023-46129 fkie_cve-2023-46129 2026-10-03T12:40:58.119540+00:00

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The cryptographic key handling library, nkeys, recently gained support for encryption, not just for signing/authentication. This is used in nats-server 2.10 (Sep 2023) and newer for authentication callouts. In nkeys versions 0.4.0 through 0.4.5, corresponding with NATS server versions 2.10.0 through 2.10.3, the nkeys library's `xkeys` encryption handling logic mistakenly passed an array by value into an internal function, where the function mutated that buffer to populate the encryption key to use. As a result, all encryption was actually to an all-zeros key. This affects encryption only, not signing. FIXME: FILL IN IMPACT ON NATS-SERVER AUTH CALLOUT SECURITY. nkeys Go library 0.4.6, corresponding with NATS Server 2.10.4, has a patch for this issue. No known workarounds are available. For any application handling auth callouts in Go, if using the nkeys library, update the dependency, recompile and deploy that in lockstep.

 https://cve.radiocsirt.org/vuln/ghsa-mr45-rx8q-wcm9 GHSA-mr45-rx8q-wcm9 — xkeys seal encryption used fixed key for all encryption 2026-10-03T12:40:58.119568+00:00

Affected: Go: github.com/nats-io/nkeys, Go: github.com/nats-io/nats-server/v2

## Background

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.

The cryptographic key handling library, nkeys, recently gained support for encryption, not just for signing/authentication. This is used in nats-server 2.10 (Sep 2023) and newer for authentication callouts.

## Problem Description

The nkeys library's "xkeys" encryption handling logic mistakenly passed an array by value into an internal function, where the function mutated that buffer to populate the encryption key to use. As a result, all encryption was actually to an all-zeros key.

This affects encryption only, not signing. FIXME: FILL IN IMPACT ON NATS-SERVER AUTH CALLOUT SECURITY.

## Affected versions

nkeys Go library: * 0.4.0 up to and including 0.4.5 * Fixed with nats-io/nkeys: 0.4.6

NATS Server: * 2.10.0 up to and including 2.10.3 * Fixed with nats-io/nats-server: 2.10.4

## Solution

Upgrade the nats-server. For any application handling auth callouts in Go, if using the nkeys library, update the dependency, recompile and deploy that in lockstep.

## Credits

Problem reported by Quentin Matillat (GitHub @tinou98).

 https://cve.radiocsirt.org/vuln/gsd-2023-46129 gsd-2023-46129 2026-10-03T12:40:58.119606+00:00 gsd-2023-46129 https://cve.radiocsirt.org/vuln/msrc_cve-2023-46129 msrc_CVE-2023-46129 — xkeys Seal encryption used fixed key for all encryption 2026-10-03T12:40:58.119618+00:00 msrc_CVE-2023-46129 https://cve.radiocsirt.org/vuln/rhsa-2023:7663 RHSA-2023:7663 — Red Hat Security Advisory: Red Hat OpenShift distributed tracing 3.0.0 operator/operand containers 2026-10-03T12:40:58.119634+00:00

opentelemetry: DoS vulnerability in otelhttp nkeys: xkeys Seal encryption used fixed key for all encryption

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-46129 UBUNTU-CVE-2023-46129 2026-10-03T12:40:58.119671+00:00

Affected: Ubuntu:20.04:LTS: golang-github-nats-io-nkeys, Ubuntu:22.04:LTS: golang-github-nats-io-nkeys

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The cryptographic key handling library, nkeys, recently gained support for encryption, not just for signing/authentication. This is used in nats-server 2.10 (Sep 2023) and newer for authentication callouts. In nkeys versions 0.4.0 through 0.4.5, corresponding with NATS server versions 2.10.0 through 2.10.3, the nkeys library's `xkeys` encryption handling logic mistakenly passed an array by value into an internal function, where the function mutated that buffer to populate the encryption key to use. As a result, all encryption was actually to an all-zeros key. This affects encryption only, not signing. FIXME: FILL IN IMPACT ON NATS-SERVER AUTH CALLOUT SECURITY. nkeys Go library 0.4.6, corresponding with NATS Server 2.10.4, has a patch for this issue. No known workarounds are available. For any application handling auth callouts in Go, if using the nkeys library, update the dependency, recompile and deploy that in lockstep.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-3067 WID-SEC-W-2023-3067 — Red Hat OpenShift: Mehrere Schwachstellen 2026-10-03T12:40:58.119702+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um einen Denial of Service Angriff durchzuführen und um Sicherheitsmechanismen zu umgehen.