CVE-2020-28466: Denial of Service (DoS)
This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the server using configs that represent a service export/import cycles. Disclaimer from the maintainers - Running a NATS service which is exposed to untrusted users presents a heightened risk. Any remote execution flaw or equivalent seriousness, or denial-of-service by unauthenticated users, will lead to prompt releases by the NATS maintainers. Fixes for denial of service issues with no threat of remote execution, when limited to account holders, are likely to just be committed to the main development branch with no special attention. Those who are running such services are encouraged to build regularly from git.
Other sources
This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the server using configs that represent a service export/import cycles. Disclaimer from the maintainers: Running a NATS service which is exposed to untrusted users presents a heightened risk. Any remote execution flaw or equivalent seriousness, or denial-of-service by unauthenticated users, will lead to prompt releases by the NATS maintainers. Fixes for denial of service issues with no threat of remote execution, when limited to account holders, are likely to just be committed to the main development branch with no special attention. Those who are running such services are encouraged to build regularly from git.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2020-28466?
The severity of CVE-2020-28466 is high, with a CVSS score of 7.5.
Which versions of github.com/nats-io/nats-server/server are affected by CVE-2020-28466?
All versions of github.com/nats-io/nats-server/server are affected by CVE-2020-28466.
How can untrusted accounts exploit the vulnerability in CVE-2020-28466?
Untrusted accounts can crash the server using configs that represent a service export/import cycles.
What is the recommended remedy for CVE-2020-28466?
It is recommended to update to version 2.2.0 of github.com/nats-io/nats-server/server to fix CVE-2020-28466.
Where can I find more information about CVE-2020-28466?
More information about CVE-2020-28466 can be found on the NVD website (https://nvd.nist.gov/vuln/detail/CVE-2020-28466) and the GitHub repository for nats-server (https://github.com/nats-io/nats-server/pull/1731).