high7.5
CVE-2019-13126
Integer Overflow or Wraparound in NATS Server
Impact
An integer overflow in NATS Server before 2.2.0 allows a remote attacker to crash the server by sending a crafted request. ### Specific Go Packages Affected github.com/nats-io/nats-server/v2/server
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/nats-io/nats-server/v2 | < 2.2.0 | 2.2.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Linuxfoundation | Nats-Server | before 2.0.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/nats-io/nats-server/pull/1053
- https://www.twistlock.com/labs-blog/finding-dos-vulnerability-nats-go-fuzz-cve-2019-13126/
- https://github.com/advisories/GHSA-jp4j-47f9-2vc3
- https://nvd.nist.gov/vuln/detail/CVE-2019-13126
- https://github.com/nats-io/nats-server/pull/1441
- https://github.com/nats-io/nats-server/commit/07ef71ff98f45f8c2711be4aeaf484610d891dda
- https://github.com/nats-io/nats-server/commits/master