UBUNTU-CVE-2026-33248

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-33248

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-33248.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-33248

Upstream

CVE-2026-33248

Published

2026-03-27T00:00:00Z

Modified

2026-03-27T17:20:24.469958Z

Severity

4.2 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, when using mTLS for client identity, with verify_and_map to derive a NATS identity from the client certificate's Subject DN, certain patterns of RDN would not be correctly enforced, allowing for authentication bypass. This does require a valid certificate from a CA already trusted for client certificates, and DN naming patterns which the NATS maintainers consider highly unlikely. So this is an unlikely attack. Nonetheless, administrators who have been very sophisticated in their DN construction patterns might conceivably be impacted. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, developers should review their CA issuing practices.

References

Affected packages

Ubuntu:24.04:LTS / nats-server

Package

Name: nats-server
Purl: pkg:deb/ubuntu/nats-server@2.10.7-1ubuntu0.3?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.9.19-1build1

2.10.3-1

2.10.4-1

2.10.7-1

2.10.7-1ubuntu0.1

2.10.7-1ubuntu0.2

2.10.7-1ubuntu0.3

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "golang-github-nats-io-nats-server-dev",
            "binary_version": "2.10.7-1ubuntu0.3"
        },
        {
            "binary_name": "nats-server",
            "binary_version": "2.10.7-1ubuntu0.3"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-33248.json"

Ubuntu:25.10 / nats-server