CVE-2020-28466: Denial of Service (DoS)

Security readout for executives and security teams

This issue can let an untrusted NATS account crash a NATS server by creating service export/import cycles. The business impact is service outage, not data theft. The bundle does not identify a fixed release version, so teams should verify vendor guidance and deployed builds before assuming remediation. Exposure is most likely where NATS services allow untrusted or customer-controlled accounts, especially with service import/export configuration. Internal-only deployments with tightly controlled account configuration have lower practical exposure, but should still verify affected code and configuration. Treat this as a high-priority availability risk for externally exposed or multi-tenant NATS deployments. It is less urgent for isolated internal systems, but remediation should still be tracked because outages can affect dependent services. Mitigation focus: Check NATS vendor guidance for the fixed build or release.; Update nats-server to a version containing the upstream fix.; Restrict untrusted account access until remediation is confirmed..

Prepared

May 24, 2026, 09:01 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.