Description
NATS.io NATS Server before 2.8.2 and Streaming Server before 0.24.6 could allow a remote attacker to bypass security restrictions, caused by the failure to enforce negative user permissions in one scenario. By using a queue subscription on the wildcard, an attacker could exploit this vulnerability to allow denied subjects.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nats-server | 2.9.8-1 | — |
| Debian 13 | nats-server | 2.9.8-1 | — |
| Debian 12 | nats-server | 2.9.8-1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/nats-io/nats-server | all versions | — | GO-2024-2980 |
| Go | github.com/nats-io/nats-server/v2 | < 2.8.2 | 2.8.2 | GHSA-2h2x-8hh2-mfq8 |
| Go | github.com/nats-io/nats-streaming-server | < 0.24.6 | 0.24.6 | GHSA-2h2x-8hh2-mfq8 |