CVE-2026-58251

{"id": "CVE-2026-58251", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-58251", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-09T13:40:09.306056Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "nats-io", "product": "nats-server", "versions": [{"status": "affected", "version": "< 2.11.16"}, {"status": "affected", "version": ">= 2.12.0-RC.1, < 2.12.7"}]}]}], "published": "2026-07-08T20:16:54.630", "references": [{"url": "https://github.com/nats-io/nats-server/commit/013586288078def45a6788096924eb4d150db65c", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nats-io/nats-server/commit/79c2f6e9ff87f594596337b6427dda85c38d1fe1", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nats-io/nats-server/commit/b9ffb63b85e7db3d25a13b2e234f5f7f7c13164d", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nats-io/nats-server/releases/tag/v2.11.16", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nats-io/nats-server/releases/tag/v2.12.7", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nats-io/nats-server/releases/tag/v2.14.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nats-io/nats-server/security/advisories/GHSA-jx8g-9g95-6322", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-285"}]}], "descriptions": [{"lang": "en", "value": "NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, an authenticated user with subscription deny permissions could bypass a plain subject deny rule by using a queue subscription, because queue-specific deny evaluation could override the plain subject deny result when the queue name itself was not denied. This issue is fixed in versions 2.14.0, 2.12.7, and 2.11.16."}, {"lang": "es", "value": "NATS Server es un servidor de alto rendimiento para NATS.io, el sistema de mensajer\u00eda nativo de la nube y del borde. Antes de las versiones 2.14.0, 2.12.7 y 2.11.16, un usuario autenticado con permisos de denegaci\u00f3n de suscripci\u00f3n pod\u00eda eludir una regla de denegaci\u00f3n de asunto simple al usar una suscripci\u00f3n de cola, porque la evaluaci\u00f3n de denegaci\u00f3n espec\u00edfica de la cola pod\u00eda anular el resultado de denegaci\u00f3n de asunto simple cuando el nombre de la cola en s\u00ed no estaba denegado. Este problema est\u00e1 solucionado en las versiones 2.14.0, 2.12.7 y 2.11.16."}], "lastModified": "2026-10-25T17:10:00.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "64D69F6E-293C-4D5F-92F6-8479213F7727", "versionEndExcluding": "2.11.16"}, {"criteria": "cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DEE2D11B-BD56-4479-A5EB-79F352DA68AB", "versionEndExcluding": "2.12.7", "versionStartIncluding": "2.12.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}