github.com/nats-io/jwt

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

High 7.5

CVE-2021-3127

nats-io/jwt not enforcing checking of Import token permissions

NATS Server 2.x before 2.2.0 and JWT library before 2.0.1 have Incorrect Access Control because Import Token bindings are mishandled.

github.com/nats-io/nats-server/v2 golang-github-nats-io-jwt github.com/nats-io/jwt golang-github-nats-io-jwt Debian Ubuntu Go

Mar 16, 2021
Critical 9.8

CVE-2020-26892

Incorrect handling of credential expiry by /nats-io/nats-server

The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of how expired credentials are handled.

github.com/nats-io/nats-server/v2 github.com/nats-io/jwt golang-github-nats-io-jwt golang-github-nats-io-jwt Debian Ubuntu Go

Nov 6, 2020
High 7.5

CVE-2020-26521

Nil dereference in NATS JWT, DoS of nats-server

The JWT library in NATS nats-server before 2.1.9 allows a denial of service (a nil dereference in Go code).

github.com/nats-io/nats-server/v2 golang-github-nats-io-jwt github.com/nats-io/jwt golang-github-nats-io-jwt Debian Ubuntu Go

Nov 6, 2020