Log in Start free

Vulnerability · Published Mar 7, 2021 · Assigned by snyk

CVE-2020-28466Denial of Service (DoS)

High 7.5

In plain English

A high-severity security flaw in github.com/nats-io/nats-server/server. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.7% (higher than 90% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)3.7%top 10.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the server using configs that represent a service export/import cycles. Disclaimer from the maintainers: Running a NATS service which is exposed to untrusted users presents a heightened risk. Any remote execution flaw or equivalent seriousness, or denial-of-service by unauthenticated users, will lead to prompt releases by the NATS maintainers. Fixes for denial of service issues with no threat of remote execution, when limited to account holders, are likely to just be committed to the main development branch with no special attention. Those who are running such services are encouraged to build regularly from git.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/nats-io/nats-server2.2.0GHSA-m4jx-6526-vvhm
Gogithub.com/nats-io/nats-serverno fix listedGO-2022-0855
Gogithub.com/nats-io/nats-server/v22.2.0GHSA-m4jx-6526-vvhm
Gogithub.com/nats-io/nats-server/v22.2.0GO-2022-0855

Affected products (as reported)

VendorProductVersions
n/a github.com/nats-io/nats-server/server 0 – before unspecified

References