SB2026111333 - Multiple vulnerabilities in nats-server

Description

This security bulletin contains information about 3 vulnerabilities.

1) Improper Certificate Validation (CVE-ID: N/A)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass TLS certificate revocation checks, potentially compromising the confidentiality and integrity of connections.

The vulnerability exists due to improper certificate validation in the NATS Server OCSP validation component when checking certificate revocation status. A remote attacker can supply a valid OCSP response for another certificate from the same issuer to have a revoked certificate accepted by the affected revocation check.

2) Uncontrolled Memory Allocation (CVE-ID: N/A)

CWE-ID: CWE-789 - Uncontrolled Memory Allocation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service by exhausting server memory or stalling message delivery.

The vulnerability exists due to memory allocation with an excessive size value in the NATS Server subscription-matching functionality when matching messages using queue subscription weights advertised by peers. A remote user can advertise a specially crafted queue subscription weight over a route or leafnode connection accepted by the server to trigger excessive memory allocation while a subscription-list lock is held, stalling message delivery or terminating the server through memory exhaustion.

3) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service through excessive memory consumption, stalled message delivery, or server process termination.

The vulnerability exists due to uncontrolled memory allocation in the nats-server queue subscription matching logic when resolving subscriptions using weights supplied by route or leafnode peers. A remote attacker can supply a crafted queue subscription weight through an accepted route or leafnode peer to exhaust server memory and disrupt message delivery.

Remediation

Install update from vendor's website.

References

• https://github.com/nats-io/nats-server/security/advisories/GHSA-65q4-982r-rm5c
• https://github.com/nats-io/nats-server/security/advisories/GHSA-27c4-m7hq-v6pw
• https://github.com/nats-io/nats-server/security/advisories/GHSA-5v9x-4f9q-q7qj