Skip to content
OpenAdvisories
High RHSA-2026:36016 6 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Aug 22, 2026 · Updated Sep 6, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 nats-server2.14 0:2.14.3-1.hum1

Vulnerabilities 6

  • High 7.5
    CVE-2026-58210

    NATS Server: MQTT partial CONNECT packets can exhaust pre-auth memory

    NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, an unauthenticated MQTT client could cause the server to retain large incomplete MQTT CONNECT packets before authentication complete…

    nats-io nats-server nats-server nats-server Debian Ubuntu
  • High 7.1
    CVE-2026-58213

    NATS Server: MQTT SUBSCRIBE Protocol Injection via Leaf Node/Route Forwarding allows arbitrary NATS command injection

    NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.1 and 2.12.9, an MQTT client could include protocol control characters in subscription filters that were later forwarded as NATS protocol data to r…

    nats-io nats-server nats-server nats-server Debian Ubuntu
  • Medium 5.4
    CVE-2026-58211

    NATS Server: `no_auth_user` pre-CONNECT fast path bypasses user connection restrictions

    NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, a client could be registered as the configured no_auth_user through a parser path used when the first client operation was not CONNE…

    nats-io nats-server nats-server nats-server Debian Ubuntu
  • Medium 5.3
    CVE-2026-58254

    NATS Server: Incomplete fix for CVE-2026-33249: Leaf node connections bypass Nats-Trace-Dest permission check

    NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.8, message trace destination checks were applied to ordinary client connections but not consistently to messages arriving through leafno…

    nats-io nats-server nats-server nats-server Debian Ubuntu
  • Medium 4.3
    CVE-2026-58209

    NATS Server: MQTT retained and QoS replay bypass subscribe deny filters

    NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, MQTT retained message delivery and QoS1+ durable replay could deliver messages whose original topics matched a subscriber configured…

    nats-io nats-server telegraf nats-server Debian Ubuntu Azure Linux
  • Medium 4.3
    CVE-2026-58214

    NATS Server: MQTT subscribe ACL bypass via $MQTT.deliver.pubrel prefix (incomplete fix for CVE-2026-33217)

    NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, an authenticated MQTT client could subscribe to the internal $MQTT.deliver.pubrel subject family, bypassing configured subscribe per…

    nats-io nats-server nats-server nats-server Debian Ubuntu

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-58213
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-58210
  • report
    https://access.redhat.com/security/cve/CVE-2026-58211
  • report
    https://access.redhat.com/security/cve/CVE-2026-58209
  • report
    https://access.redhat.com/security/cve/CVE-2026-58214
  • report
    https://access.redhat.com/security/cve/CVE-2026-58254
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_36016.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2498259
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-58209
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-58209
  • article
    https://github.com/nats-io/nats-server/commit/181b1f51f40b9954c57e9d478e051fb257679356
  • article
    https://github.com/nats-io/nats-server/commit/1c429b6fdc5afd4188cc5faf1127f6334896cd87
  • article
    https://github.com/nats-io/nats-server/releases/tag/v2.12.12
  • article
    https://github.com/nats-io/nats-server/releases/tag/v2.14.3
  • article
    https://github.com/nats-io/nats-server/security/advisories/GHSA-7qmq-8cc4-hxwg
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2498247
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-58210
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-58210
  • article
    https://github.com/nats-io/nats-server/commit/bce9ef39469e610aeddb819194ceb7f7edfc0861
  • article
    https://github.com/nats-io/nats-server/commit/e016e47bbf70304945f2ae9dc397e4862adefaf5
  • article
    https://github.com/nats-io/nats-server/security/advisories/GHSA-r72h-j7qq-v6qg
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2498258
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-58211
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-58211
  • article
    https://github.com/nats-io/nats-server/security/advisories/GHSA-hmmp-q8cx-v964
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2498249
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-58213
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-58213
  • article
    https://github.com/nats-io/nats-server/commit/366837cfc65ab9ccb4f98193c65e8daf238582d8
  • article
    https://github.com/nats-io/nats-server/commit/64ebae40051ee497c481e10f316238faf0de1736
  • article
    https://github.com/nats-io/nats-server/commit/f14856b9e57a36818f43851cb69b6e33670885c9
  • article
    https://github.com/nats-io/nats-server/pull/8163
  • article
    https://github.com/nats-io/nats-server/pull/8164
  • article
    https://github.com/nats-io/nats-server/releases/tag/v2.12.9
  • article
    https://github.com/nats-io/nats-server/releases/tag/v2.14.1
  • article
    https://github.com/nats-io/nats-server/security/advisories/GHSA-qrcv-3558-gj4f
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2498260