CVE-2026-58209

4.3 Moyenne

Publiée le 08/07/2026 à 22:16 · Modifiée le 13/07/2026 à 16:15 · Analysée par le NVD · Source : security-advisories@github.com

Description

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, MQTT retained message delivery and QoS1+ durable replay could deliver messages whose original topics matched a subscriber configured subscribe deny rule because these delivery paths did not consistently recheck the concrete original topic before sending the MQTT PUBLISH to the subscriber. This issue is fixed in versions 2.14.3 and 2.12.12.

Traduire en français

Produits concernés

nats-io nats-server
Linuxfoundation nats-server

Scores CVSS

Version	Score	Source	Vecteur
3.1	4.3 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N`

Faiblesses (CWE)

CWE-863

Références

https://github.com/nats-io/nats-server/commit/181b1f51f40b9954c57e9d478e051fb257679356 Patch
https://github.com/nats-io/nats-server/commit/1c429b6fdc5afd4188cc5faf1127f6334896cd87 Patch
https://github.com/nats-io/nats-server/releases/tag/v2.12.12 Release Notes
https://github.com/nats-io/nats-server/releases/tag/v2.14.3 Release Notes
https://github.com/nats-io/nats-server/security/advisories/GHSA-7qmq-8cc4-hxwg Vendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories