nats-top

4 results · Clear filters · Feed

• Critical 9.6
  CVE-2026-39821

  Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

  The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege …

  Go standard library golang.org/x/net net/http net/http/internal/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 22, 2026
• Critical 9.8
  CVE-2026-27143

  Missing bound checks can lead to memory corruption in safe Go in cmd/compile

  Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the compiler would allow for invalid indexing to occur at runtime, potentially leading to memory corruption.

  Go toolchain cmd/compile katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Apr 8, 2026
• Critical 9.1
  CVE-2025-68121

  Unexpected session resumption in crypto/tls

  During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user ca…

  Go standard library crypto/tls langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go
  Feb 5, 2026
• Critical 9.6
  CVE-2025-30215

  NATS-Server Fails to Authorize Certain Jetstream Admin APIs

  NATS-Server is a High-Performance server for NATS.io, the cloud and edge native messaging system. In versions starting from 2.2.0 but prior to 2.10.27 and 2.11.1, the management of JetStream assets happens with messages in the $JS. subject namespace in the sy…

  nats-io nats-server telegraf nats-server Debian Ubuntu Azure Linux Alpine Wolfi Go
  Apr 15, 2025