pkg:Debian/nats-server

所有已知漏洞

• CRITICAL9.6CVE-2025-30215Missing ACLs on JavaScript APIs allowing privilege escalation github.com/nats-io/nats-server
  from 0
• HIGH8.6CVE-2026-33216NATS has MQTT plaintext password disclosure
  from 0
• HIGH7.5CVE-2026-27889NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead
  from 0
• HIGH7.5CVE-2026-33218NATS has pre-auth server panic via leafnode handling
  from 0
• HIGH7.5CVE-2026-29785NATS Server panic via malicious compression on leafnode port in github.com/nats-io/nats-server
  from 0
• HIGH7.5CVE-2023-46129xkeys seal encryption used fixed key for all encryption
  from 0, < 2.10.4-1
• HIGH7.4CVE-2026-33247NATS credentials are exposed in monitoring port via command-line argv
  from 0
• HIGH7.1CVE-2026-33217NATS allows MQTT clients to bypass ACL checks
  from 0
• MEDIUM6.5CVE-2026-33215NATS is vulnerable to MQTT hijacking via Client ID
  from 0
• MEDIUM6.5CVE-2022-29946NATS Server and Streaming Server fails to enforce negative user permissions, may allow denied subjects in github.com/nats-io/nats-server
  from 0, < 2.9.8-1
• MEDIUM6.5CVE-2023-47090Authorization bypass in github.com/nats-io/nats-server/v2
  from 0
• MEDIUM6.4CVE-2026-33246NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers
  from 0
• MEDIUM6.4CVE-2026-33223NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing
  from 0
• MEDIUM5.9CVE-2026-27571nats-server websockets are vulnerable to pre-auth memory DoS
  from 0
• MEDIUM5.3CVE-2026-33219NATS is vulnerable to pre-auth DoS through WebSockets client service
  from 0
• MEDIUM4.9CVE-2026-33222NATS JetStream has an authorization bypass through its Management API
  from 0
• MEDIUM4.3CVE-2026-33249NATS: Message tracing can be redirected to arbitrary subject
  from 0, < 2.12.6-1
• MEDIUM4.2CVE-2026-33248NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching
  from 0