SB2026111334 - Multiple vulnerabilities in nats-server

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026111334

SB2026111334 - Multiple vulnerabilities in nats-server

Published: November 13, 2026

Security Bulletin ID SB2026111334
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 67% Low 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 vulnerabilities.


1) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service through excessive memory consumption.

The vulnerability exists due to uncontrolled resource consumption in JetStream backup format detection when processing incoming compressed stream backups. A remote user can submit a crafted backup using stream-restore permissions to cause incoming data to accumulate without a finite buffer limit while format detection waits for recognizable output, exhausting memory and disrupting the server process.

Account stream-storage limits do not bound the temporary format-detection buffer.


2) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass required proxy authentication and potentially access or modify protected messaging data.

The vulnerability exists due to improper access control in nats-server when applying connection restrictions from a scoped signing key template. A remote user can establish a direct connection despite an effective template requiring an authenticated proxy to bypass proxy authentication and potentially read or modify protected messaging data.

Both direct JWT authentication and authorization callouts are affected.


3) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass external authorization checks and gain unauthorized read and write access to information.

The vulnerability exists due to improper access control in the authorization callout exemption logic in nats-server when evaluating client-supplied identity fields during connection authentication. A remote user can supply identity fields that identify an exempt service user but do not match the authenticated credentials to skip the external authorization decision and gain unauthorized read and write access to information.


4) Allocation of Resources Without Limits or Throttling (CVE-ID: N/A)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to exhaust storage available to their account and cause a denial of service for other MQTT users of that account.

The vulnerability exists due to allocation of persistent storage without adequate limits in the nats-server MQTT QoS 2 delivery-state handling when processing acknowledgements that do not correspond to an outstanding delivery. A remote user can send unexpected MQTT acknowledgements to accumulate unnecessary persistent records in JetStream and exhaust account storage, disrupting MQTT service.


5) Allocation of Resources Without Limits or Throttling (CVE-ID: N/A)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service through memory and CPU exhaustion, affecting other clients and accounts, including users of other protocols.

The vulnerability exists due to insufficient enforcement of buffering limits and repeated copying of accumulated data in the NATS Server MQTT packet assembly component when assembling packets after CONNECT. A remote attacker can send an oversized or slowly completed packet to consume excessive memory and CPU before message-level checks run, causing a denial of service.


6) Allocation of Resources Without Limits or Throttling (CVE-ID: N/A)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service affecting the entire server process through resource exhaustion.

The vulnerability exists due to allocation of resources without consistently enforced size limits in the nats-server MQTT packet reader when processing subscription requests after CONNECT. A remote attacker can send oversized subscription packets that reach buffering and filter parsing despite max_payload to cause excessive memory allocations and exhaust server resources before subscription-count limits are applied.


Remediation

Install update from vendor's website.

References