VulnerabilityBSI CERT-Bund
NATS Server: Mehrere Schwachstellen
NEOSEC enrichment — no mirror of the original source
Ein Angreifer kann mehrere Schwachstellen in NATS Server ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen und um Dateien zu manipulieren.
Source: BSI CERT-Bund. For licensing reasons NEOSEC Intel does not mirror the full text verbatim. The full text and expert commentary are available at the original source.
Read the issue at BSI CERT-BundFull advisory
Highbsi:WID-SEC-2026-45600 linked CVEs
Open advisory with all CVEs
More on Server
Other advisories
- Not ratedosv:RLSA-2026:99865Moderate: xorg-x11-server security update
- Not ratedosv:CLEANSTART-2026-PY55640In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled
- Not ratedosv:CLEANSTART-2026-RW02247HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently
- Not ratedosv:CLEANSTART-2026-FS91009For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in th...
- Not ratedosv:CLEANSTART-2026-YI51495HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...
- Not ratedosv:CLEANSTART-2026-OR42651malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW...
- Not ratedosv:CLEANSTART-2026-SN80404When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request
- MediumCVE-2026-82102IBM DataStage on Cloud Pak for Data: Server-Side-Request-Forgery (SSRF)
Other news entries
- PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCENewsThe Hacker News
- New Mior and Skyfall Attacks Let Rogue Cloud Hosts Steal Secrets From AMD SEV-SNP VMsNewsThe Hacker News
- Microsoft Struggles to Restore Email and Other Services in a Global OutageNewsSecurityWeek
- Quantum Systems drones back in the air after malware scareNewsThe Register — Security
- Spotfire Server: Mehrere SchwachstellenVulnerabilityBSI CERT-Bund
- Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen LoginsNewsThe Hacker News
- Law Enforcement Disrupts Gootloader, CastleRAT, and StealC InfrastructureNewsSecurityWeek
- Apache HTTP Server: Mehrere SchwachstellenVulnerabilityBSI CERT-Bund
Source: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-4560
ID