DEBIAN-CVE-2026-33215

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-33215
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-33215.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-33215
Upstream
  • CVE-2026-33215
Published
2026-03-24T21:16:28.640Z
Modified
2026-03-27T10:03:11.783704Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server provides an MQTT client interface. Prior to versions 2.11.15 and 2.12.5, Sessions and Messages can by hijacked via MQTT Client ID malfeasance. Versions 2.11.15 and 2.12.5 patch the issue. No known workarounds are available.

References

Affected packages

Debian:12 / nats-server

Package

Name
nats-server
Purl
pkg:deb/debian/nats-server?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.9.10-1
2.9.19-1
2.10.1-1
2.10.3-1
2.10.4-1
2.10.7-1
2.10.16-1
2.10.18-1
2.10.24-1
2.10.27-1
2.12.4-1
2.12.6-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-33215.json"

Debian:13 / nats-server

Package

Name
nats-server
Purl
pkg:deb/debian/nats-server?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.10.27-1
2.12.4-1
2.12.6-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-33215.json"

Debian:14 / nats-server

Package

Name
nats-server
Purl
pkg:deb/debian/nats-server?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.10.27-1
2.12.4-1
2.12.6-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-33215.json"