UBUNTU-CVE-2026-33249

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-33249

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-33249.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-33249

Upstream

CVE-2026-33249

Published

2026-03-27T00:00:00Z

Modified

2026-03-27T17:20:07.597340Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.11.0 and prior to versions 2.11.15 and 2.12.6, a valid client which uses message tracing headers can indicate that the trace messages can be sent to an arbitrary valid subject, including those to which the client does not have publish permission. The payload is a valid trace message and not chosen by the attacker. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.

References

Affected packages

Ubuntu:24.04:LTS / nats-server

Package

Name: nats-server
Purl: pkg:deb/ubuntu/nats-server@2.10.7-1ubuntu0.3?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.9.19-1build1

2.10.3-1

2.10.4-1

2.10.7-1

2.10.7-1ubuntu0.1

2.10.7-1ubuntu0.2

2.10.7-1ubuntu0.3

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "golang-github-nats-io-nats-server-dev",
            "binary_version": "2.10.7-1ubuntu0.3"
        },
        {
            "binary_name": "nats-server",
            "binary_version": "2.10.7-1ubuntu0.3"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-33249.json"

Ubuntu:25.10 / nats-server