A vulnerability marked as critical has been reported in nats-io nats-server up to 2.11.14/2.12.5. This vulnerability affects the function verify_and_map of the component mTLS. This manipulation causes improper certificate validation. The attack may be initiated remotely.
| Vendor | Product | Versions |
|---|---|---|
| go | github.com/nats-io/nats-server/v2 | go/github.com/nats-io/nats-server/v2: < 2.11.15, go/github.com/nats-io/nats-server/v2: >= 2.12.0-RC.1, < 2.12.6, go/github.com/nats-io/nats-server/v2: <= 2.11.14, go/github.com/nats-io/nats-server/v2: <= 2.12.5 |
Updated severity to CRITICAL, added affected versions up to 2.11.14/2.12.5, and noted that the vulnerability is actively exploited.
Initial creation
