0Xasritha

**Name of the Vulnerable Software and Affected Versions** NATS Server versions prior to 2.14.3 NATS Server versions prior to 2.12.12 **Description** MQTT retained message delivery and QoS1+ durable replay may deliver messages to subscribers even if the original topics match a configured subscribe deny rule. This occurs because the delivery paths fail to consistently recheck the concrete original topic before sending the MQTT PUBLISH message to the subscriber. **Recommendations** Update NATS Server to version 2.14.3 or later. Update NATS Server to version 2.12.12 or later.

**Name of the Vulnerable Software and Affected Versions** NATS Server versions prior to 2.14.3 NATS Server versions prior to 2.12.12 **Description** An unauthenticated MQTT client can cause the server to consume excessive memory by sending large incomplete MQTT CONNECT packets. The server retains these packets while the parser waits for the advertised packet length to be completed before authentication is finalized, leading to memory exhaustion. **Recommendations** Update NATS Server to version 2.14.3. Update NATS Server to version 2.12.12.