GO-2025-3600

See a problem?
Please try reporting it to the source first.

Source

https://pkg.go.dev/vuln/GO-2025-3600

Import Source

https://vuln.go.dev/ID/GO-2025-3600.json

JSON Data

https://api.osv.dev/v1/vulns/GO-2025-3600

Aliases

Published

2025-04-22T15:29:23Z

Modified

2025-04-22T16:11:47.025671Z

Summary

Missing ACLs on JavaScript APIs allowing privilege escalation github.com/nats-io/nats-server

Details

Missing

Database specific

{
    "review_status": "REVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2025-3600"
}

References

Credits

- Thomas Morgan

Affected packages

Go / github.com/nats-io/nats-server/v2

Package

Name: github.com/nats-io/nats-server/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/nats-io/nats-server/v2

Affected ranges

Type: SEMVER
Events: Introduced

2.2.0

Fixed

2.10.27

Introduced

2.11.0

Fixed

2.11.1

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/nats-io/nats-server/v2/server",
            "symbols": [
                "Account.AddServiceImport",
                "Account.AddServiceImportWithClaim",
                "Account.DisableJetStream",
                "Account.EnableJetStream",
                "Account.RestoreStream",
                "Account.TrackServiceExport",
                "Account.TrackServiceExportWithSampling",
                "Account.UnTrackServiceExport",
                "CacheDirAccResolver.Reload",
                "CacheDirAccResolver.Start",
                "ConfigureOptions",
                "DirAccResolver.Fetch",
                "DirAccResolver.Reload",
                "DirAccResolver.Start",
                "DirAccResolver.Store",
                "DirJWTStore.Merge",
                "DirJWTStore.Pack",
                "DirJWTStore.PackWalk",
                "DirJWTStore.Reload",
                "DirJWTStore.SaveAcc",
                "DirJWTStore.SaveAct",
                "New",
                "NewCacheDirAccResolver",
                "NewDirAccResolver",
                "NewExpiringDirJWTStore",
                "NewServer",
                "Options.ProcessConfigFile",
                "ProcessConfigFile",
                "Run",
                "Server.AcceptLoop",
                "Server.AccountStatz",
                "Server.Accountz",
                "Server.ActivePeers",
                "Server.Connz",
                "Server.DisableJetStream",
                "Server.DisconnectClientByID",
                "Server.EnableJetStream",
                "Server.Gatewayz",
                "Server.HandleAccountStatz",
                "Server.HandleAccountz",
                "Server.HandleConnz",
                "Server.HandleGatewayz",
                "Server.HandleHealthz",
                "Server.HandleIPQueuesz",
                "Server.HandleSubsz",
                "Server.HandleVarz",
                "Server.InProcessConn",
                "Server.Ipqueuesz",
                "Server.JetStreamEnabledForDomain",
                "Server.JetStreamIsStreamAssigned",
                "Server.JetStreamIsStreamCurrent",
                "Server.JetStreamSnapshotMeta",
                "Server.JetStreamSnapshotStream",
                "Server.JetStreamStepdownConsumer",
                "Server.JetStreamStepdownStream",
                "Server.LameDuckShutdown",
                "Server.LookupAccount",
                "Server.LookupOrRegisterAccount",
                "Server.NumLoadedAccounts",
                "Server.NumSubscriptions",
                "Server.RegisterAccount",
                "Server.Reload",
                "Server.ReloadOptions",
                "Server.SetDefaultSystemAccount",
                "Server.SetSystemAccount",
                "Server.Shutdown",
                "Server.Start",
                "Server.StartHTTPMonitoring",
                "Server.StartHTTPSMonitoring",
                "Server.StartMonitoring",
                "Server.StartProfiler",
                "Server.StartRouting",
                "Server.Subsz",
                "Server.UpdateAccountClaims",
                "Server.Varz",
                "client.RegisterNkeyUser",
                "client.RegisterUser",
                "clusterOption.Apply",
                "leafNodeOption.Apply",
                "maxConnOption.Apply",
                "mqttMaxAckPendingReload.Apply",
                "raft.AdjustClusterSize",
                "raft.InstallSnapshot",
                "raft.PauseApply",
                "raft.ProposeKnownPeers",
                "raft.ProposeRemovePeer",
                "raft.ResumeApply",
                "raft.SendSnapshot",
                "raft.StepDown",
                "raft.UpdateKnownPeers",
                "routesOption.Apply"
            ]
        }
    ]
}