https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T12:44:22.581550+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-nats-2026-33219 BIT-nats-2026-33219 — NATS is vulnerable to pre-auth DoS through WebSockets client service 2026-10-03T12:44:22.597766+00:00

Affected: Bitnami: nats

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a malicious client which can connect to the WebSockets port can cause unbounded memory use in the nats-server before authentication; this requires sending a corresponding amount of data. This is a milder variant of CVE-2026-27571. That earlier issue was a compression bomb, this vulnerability is not. Attacks against this new issue thus require significant client bandwidth. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, disable websockets if not required for project deployment.

 https://cve.radiocsirt.org/vuln/cleanstart-2026-yj62834 CLEANSTART-2026-YJ62834 — Security fix for CVE-2026-33219 applied in: nats-server-fips 2.12.5-r1 2026-10-03T12:44:22.597826+00:00

Affected: CleanStart: nats-server-fips

Security vulnerability affects the nats-server-fips package. This issue is resolved in later releases. See references for vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-365500 EUVD-2026-365500 2026-10-03T12:44:22.597849+00:00 EUVD-2026-365500 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33219 fkie_cve-2026-33219 2026-10-03T12:44:22.597864+00:00

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a malicious client which can connect to the WebSockets port can cause unbounded memory use in the nats-server before authentication; this requires sending a corresponding amount of data. This is a milder variant of CVE-2026-27571. That earlier issue was a compression bomb, this vulnerability is not. Attacks against this new issue thus require significant client bandwidth. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, disable websockets if not required for project deployment.

 https://cve.radiocsirt.org/vuln/ghsa-8r68-gvr4-jh7j GHSA-8r68-gvr4-jh7j — NATS is vulnerable to pre-auth DoS through WebSockets client service 2026-10-03T12:44:22.597889+00:00

Affected: Go: github.com/nats-io/nats-server/v2, Go: github.com/nats-io/nats-server

### Background

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.

The nats-server offers a WebSockets client service, used in deployments where browsers are the NATS clients.

### Problem Description

A malicious client which can connect to the WebSockets port can cause unbounded memory use in the nats-server before authentication; this requires sending a corresponding amount of data.

This is a milder variant of [NATS-advisory-ID 2026-02](https://advisories.nats.io/CVE/secnote-2026-02.txt) (aka CVE-2026-27571; GHSA-qrvq-68c2-7grw). That earlier issue was a compression bomb, this vulnerability is not. Attacks against this new issue thus require significant client bandwidth.

### Affected Versions

Any version before v2.12.6 or v2.11.15

### Workarounds

Disable websockets if not required for project deployment.

 https://cve.radiocsirt.org/vuln/rhsa-2026:21769 RHSA-2026:21769 — Red Hat Security Advisory: Multicluster Global Hub 1.5.4 security update 2026-10-03T12:44:22.597923+00:00

grafana/tempo: Tempo: Denial of Service via large queries net/url: Incorrect parsing of IPv6 host literals in net/url crypto/x509: Incorrect enforcement of email constraints in crypto/x509 github.com/nats-io/nats-server: NATS-Server: Denial of Service via malformed WebSockets frame github.com/nats-io/nats-server: NATS-Server: Denial of Service via leafnode compression crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages github.com/buger/jsonparser: github.com/buger/jsonparser: Denial of Service via malformed JSON input github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation nats-server: NATS-Server: Session and message hijacking via MQTT Client ID malfeasance nats-server: github.com/nats-io/nats-server: NATS-Server: Information disclosure of MQTT passwords through monitoring endpoints nats-server: github.com/nats-io/nats-server: NATS-Server: Access control bypass via unapplied ACLs in MQTT namespace nats-server: github.com/nats-io/nats-server: NATS-Server: Denial of Service via mal…

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-33219 UBUNTU-CVE-2026-33219 2026-10-03T12:44:22.597994+00:00

Affected: Ubuntu:24.04:LTS: nats-server, Ubuntu:25.10: nats-server, Ubuntu:Pro:26.04:LTS: nats-server

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a malicious client which can connect to the WebSockets port can cause unbounded memory use in the nats-server before authentication; this requires sending a corresponding amount of data. This is a milder variant of CVE-2026-27571. That earlier issue was a compression bomb, this vulnerability is not. Attacks against this new issue thus require significant client bandwidth. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, disable websockets if not required for project deployment.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0858 WID-SEC-W-2026-0858 — NATS Server: Mehrere Schwachstellen 2026-10-03T12:44:22.598019+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in NATS Server ausnutzen, um Informationen offenzulegen oder zu manipulieren, einen Denial-of-Service zu verursachen und Sicherheitsmechanismen zu umgehen.