https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 19:49:37 +0000 https://cve.radiocsirt.org/vuln/bit-nats-2026-33249 <p><strong>Affected:</strong> Bitnami: nats</p> <p>NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.11.0 and prior to versions 2.11.15 and 2.12.6, a valid client which uses message tracing headers can indicate that the trace messages can be sent to an arbitrary valid subject, including those to which the client does not have publish permission. The payload is a valid trace message and not chosen by the attacker. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.</p> <p><strong>Affected:</strong> Bitnami: nats</p> <p>NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.11.0 and prior to versions 2.11.15 and 2.12.6, a valid client which uses message tracing headers can indicate that the trace messages can be sent to an arbitrary valid subject, including those to which the client does not have publish permission. The payload is a valid trace message and not chosen by the attacker. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.</p> https://cve.radiocsirt.org/vuln/bit-nats-2026-33249 https://cve.radiocsirt.org/vuln/cleanstart-2026-qf31649 <p><strong>Affected:</strong> CleanStart: nats-server-fips</p> <p>Security vulnerability affects the nats-server-fips package. This issue is resolved in later releases. See references for vulnerability details.</p> <p><strong>Affected:</strong> CleanStart: nats-server-fips</p> <p>Security vulnerability affects the nats-server-fips package. This issue is resolved in later releases. See references for vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-qf31649 https://cve.radiocsirt.org/vuln/euvd-2026-277685 EUVD-2026-277685 https://cve.radiocsirt.org/vuln/euvd-2026-277685 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33249 <p>NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.11.0 and prior to versions 2.11.15 and 2.12.6, a valid client which uses message tracing headers can indicate that the trace messages can be sent to an arbitrary valid subject, including those to which the client does not have publish permission. The payload is a valid trace message and not chosen by the attacker. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.</p> <p>NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.11.0 and prior to versions 2.11.15 and 2.12.6, a valid client which uses message tracing headers can indicate that the trace messages can be sent to an arbitrary valid subject, including those to which the client does not have publish permission. The payload is a valid trace message and not chosen by the attacker. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-33249 https://cve.radiocsirt.org/vuln/ghsa-8m2x-3m6q-6w8j <p><strong>Affected:</strong> Go: github.com/nats-io/nats-server/v2</p> <p>### Background</p> <p>NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.</p> <p>The nats-server supports telemetry on messages, using the per-message NATS headers.</p> <p>### Problem Description</p> <p>A valid client which uses message tracing headers can indicate that the trace messages can be sent to an arbitrary valid subject, including those to which the client does not have publish permission.</p> <p>The payload is a valid trace message and not chosen by the attacker.</p> <p>### Affected Versions</p> <p>Any version before v2.12.6 or v2.11.15</p> <p>### Workarounds</p> <p>None.</p> <p><strong>Affected:</strong> Go: github.com/nats-io/nats-server/v2</p> <p>### Background</p> <p>NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.</p> <p>The nats-server supports telemetry on messages, using the per-message NATS headers.</p> <p>### Problem Description</p> <p>A valid client which uses message tracing headers can indicate that the trace messages can be sent to an arbitrary valid subject, including those to which the client does not have publish permission.</p> <p>The payload is a valid trace message and not chosen by the attacker.</p> <p>### Affected Versions</p> <p>Any version before v2.12.6 or v2.11.15</p> <p>### Workarounds</p> <p>None.</p> https://cve.radiocsirt.org/vuln/ghsa-8m2x-3m6q-6w8j https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-33249 <p><strong>Affected:</strong> Ubuntu:24.04:LTS: nats-server, Ubuntu:25.10: nats-server, Ubuntu:Pro:26.04:LTS: nats-server</p> <p>NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.11.0 and prior to versions 2.11.15 and 2.12.6, a valid client which uses message tracing headers can indicate that the trace messages can be sent to an arbitrary valid subject, including those to which the client does not have publish permission. The payload is a valid trace message and not chosen by the attacker. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.</p> <p><strong>Affected:</strong> Ubuntu:24.04:LTS: nats-server, Ubuntu:25.10: nats-server, Ubuntu:Pro:26.04:LTS: nats-server</p> <p>NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.11.0 and prior to versions 2.11.15 and 2.12.6, a valid client which uses message tracing headers can indicate that the trace messages can be sent to an arbitrary valid subject, including those to which the client does not have publish permission. The payload is a valid trace message and not chosen by the attacker. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-33249 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0858 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in NATS Server ausnutzen, um Informationen offenzulegen oder zu manipulieren, einen Denial-of-Service zu verursachen und Sicherheitsmechanismen zu umgehen.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in NATS Server ausnutzen, um Informationen offenzulegen oder zu manipulieren, einen Denial-of-Service zu verursachen und Sicherheitsmechanismen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0858