NIXPKGS-2026-2525

GitHub issue published 9 hours ago

libpcap: security issues < 1.10.7

Permalink CVE-2026-31911

5.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 9 hours ago by @LeSuisse Activity log

Created suggestion 17 hours ago
@LeSuisse ignored
3 packages
- darwin.libpcap
- python313Packages.libpcap
- python314Packages.libpcap
9 hours ago
@LeSuisse accepted 9 hours ago
@LeSuisse published on GitHub 9 hours ago

abort() in libpcap before 1.10.7 on an invalid BPF opcode

https://github.com/the-tcpdump-group/libpcap/commit/a715bcdde830299cba417151438… patch

libpcap

<1.10.7

Permalink CVE-2026-0799

8.7 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): Low (L)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 9 hours ago by @LeSuisse Activity log

Created suggestion 17 hours ago
@LeSuisse ignored
3 packages
- darwin.libpcap
- python313Packages.libpcap
- python314Packages.libpcap
9 hours ago
@LeSuisse accepted 9 hours ago
@LeSuisse published on GitHub 9 hours ago

OOBR and OOBW in libpcap before 1.10.7

https://github.com/the-tcpdump-group/libpcap/commit/48e8960a7108e9e828f9d7bdc7e… patch

libpcap

<1.10.7

Permalink CVE-2026-18238

5.0 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 9 hours ago by @LeSuisse Activity log

Created suggestion 17 hours ago
@LeSuisse ignored
3 packages
- darwin.libpcap
- python314Packages.libpcap
- python313Packages.libpcap
9 hours ago
@LeSuisse accepted 9 hours ago
@LeSuisse published on GitHub 9 hours ago

OOBR in rpcap client in libpcap before 1.10.7

https://github.com/the-tcpdump-group/libpcap/commit/b9590d482986d64673712460aae… patch

libpcap

<1.10.7
==1.9.x
==1.8.x

Permalink CVE-2026-6554

5.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 9 hours ago by @LeSuisse Activity log

Created suggestion 17 hours ago
@LeSuisse ignored
3 packages
- darwin.libpcap
- python313Packages.libpcap
- python314Packages.libpcap
9 hours ago
@LeSuisse accepted 9 hours ago
@LeSuisse published on GitHub 9 hours ago

infinte loop in libpcap before 1.10.7

https://github.com/the-tcpdump-group/libpcap/commit/ff3c83475ac303c6b681c52ad0b… patch

libpcap

<1.10.7

Permalink CVE-2026-31912

5.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 9 hours ago by @LeSuisse Activity log

Created suggestion 17 hours ago
@LeSuisse ignored
3 packages
- darwin.libpcap
- python313Packages.libpcap
- python314Packages.libpcap
9 hours ago
@LeSuisse accepted 9 hours ago
@LeSuisse published on GitHub 9 hours ago

OOBR in libpcap before 1.10.7

https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e… patch

libpcap

<1.10.7

Permalink CVE-2026-6244

5.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 9 hours ago by @LeSuisse Activity log

Created suggestion 17 hours ago
@LeSuisse ignored
3 packages
- python314Packages.libpcap
- python313Packages.libpcap
- darwin.libpcap
9 hours ago
@LeSuisse accepted 9 hours ago
@LeSuisse published on GitHub 9 hours ago

division by zero in libpcap before 1.10.7

https://github.com/the-tcpdump-group/libpcap/commit/98bb921b141aa642faedbf2ac51… patch

libpcap

<1.10.7

Permalink CVE-2026-18313

4.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

updated 9 hours ago by @LeSuisse Activity log

Created suggestion 17 hours ago
@LeSuisse ignored
3 packages
- darwin.libpcap
- python313Packages.libpcap
- python314Packages.libpcap
9 hours ago
@LeSuisse accepted 9 hours ago
@LeSuisse published on GitHub 9 hours ago

rpcapd memory leak in libpcap before 1.10.7

https://github.com/the-tcpdump-group/libpcap/commit/f9775af1a0ec76db60c7213241e… patch

libpcap

<1.10.7
==1.9.x

NIXPKGS-2026-2524

GitHub issue published 9 hours ago

libxml2: security issues < 2.15.4

Permalink CVE-2026-86143

6.9 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): Low (L)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): Low (L)

updated 9 hours ago by @LeSuisse Activity log

Created suggestion 17 hours ago
@LeSuisse ignored
7 packages
- libxml2_13
- libxml2Python
- sbclPackages.cl-libxml2
- perlPackages.AlienLibxml2
- python313Packages.libxml2
- python314Packages.libxml2
- perl5Packages.AlienLibxml2
9 hours ago
@LeSuisse accepted 9 hours ago
@LeSuisse published on GitHub 9 hours ago

In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback …

libxml2

<2.15.4

Permalink CVE-2026-86142

6.9 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): Low (L)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): Low (L)

updated 9 hours ago by @LeSuisse Activity log

Created suggestion 17 hours ago
@LeSuisse ignored
7 packages
- libxml2_13
- libxml2Python
- sbclPackages.cl-libxml2
- perlPackages.AlienLibxml2
- python313Packages.libxml2
- python314Packages.libxml2
- perl5Packages.AlienLibxml2
9 hours ago
@LeSuisse accepted 9 hours ago
@LeSuisse published on GitHub 9 hours ago

In libxml2 before 2.15.4, there is a heap-based buffer overflow …

libxml2

<2.15.4

Permalink CVE-2026-86138

6.9 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): Low (L)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): Low (L)

updated 9 hours ago by @LeSuisse Activity log

Created suggestion 17 hours ago
@LeSuisse ignored
7 packages
- libxml2_13
- libxml2Python
- sbclPackages.cl-libxml2
- perlPackages.AlienLibxml2
- python313Packages.libxml2
- python314Packages.libxml2
- perl5Packages.AlienLibxml2
9 hours ago
@LeSuisse accepted 9 hours ago
@LeSuisse published on GitHub 9 hours ago

In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer …

libxml2

<2.15.4

Permalink CVE-2026-86144

5.6 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): Low (L)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): Low (L)
Modified Availability (MA): Low (L)

updated 9 hours ago by @LeSuisse Activity log

Created suggestion 17 hours ago
@LeSuisse ignored
7 packages
- libxml2Python
- sbclPackages.cl-libxml2
- perlPackages.AlienLibxml2
- python313Packages.libxml2
- python314Packages.libxml2
- perl5Packages.AlienLibxml2
- libxml2_13
9 hours ago
@LeSuisse accepted 9 hours ago
@LeSuisse published on GitHub 9 hours ago

In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do …

libxml2

<2.15.4

Permalink CVE-2026-86139

6.9 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): Low (L)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): Low (L)

updated 9 hours ago by @LeSuisse Activity log

Created suggestion 17 hours ago
@LeSuisse ignored
7 packages
- libxml2_13
- libxml2Python
- sbclPackages.cl-libxml2
- perlPackages.AlienLibxml2
- python313Packages.libxml2
- python314Packages.libxml2
- perl5Packages.AlienLibxml2
9 hours ago
@LeSuisse accepted 9 hours ago
@LeSuisse published on GitHub 9 hours ago

In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer …

libxml2

<2.15.4

Permalink CVE-2026-86141

2.9 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

updated 9 hours ago by @LeSuisse Activity log

Created suggestion 17 hours ago
@LeSuisse ignored
7 packages
- libxml2_13
- libxml2Python
- sbclPackages.cl-libxml2
- perlPackages.AlienLibxml2
- python313Packages.libxml2
- python314Packages.libxml2
- perl5Packages.AlienLibxml2
9 hours ago
@LeSuisse accepted 9 hours ago
@LeSuisse published on GitHub 9 hours ago

xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference …

libxml2

<2.15.4

Permalink CVE-2026-86137

2.9 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

updated 9 hours ago by @LeSuisse Activity log

Created suggestion 17 hours ago
@LeSuisse ignored
7 packages
- libxml2_13
- libxml2Python
- sbclPackages.cl-libxml2
- perlPackages.AlienLibxml2
- python313Packages.libxml2
- python314Packages.libxml2
- perl5Packages.AlienLibxml2
9 hours ago
@LeSuisse accepted 9 hours ago
@LeSuisse published on GitHub 9 hours ago

In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka …

libxml2

<2.15.4

Permalink CVE-2026-86140

8.0 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): Low (L)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): Low (L)

updated 9 hours ago by @LeSuisse Activity log

Created suggestion 17 hours ago
@LeSuisse ignored
7 packages
- libxml2_13
- libxml2Python
- sbclPackages.cl-libxml2
- perlPackages.AlienLibxml2
- python313Packages.libxml2
- python314Packages.libxml2
- perl5Packages.AlienLibxml2
9 hours ago
@LeSuisse accepted 9 hours ago
@LeSuisse published on GitHub 9 hours ago

In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat …

libxml2

<2.15.4

NIXPKGS-2026-2523

GitHub issue published 1 day, 4 hours ago

Multiple issues in Ceph<20.2.4

          Permalink
          
            CVE-2026-50152
          
        9.1 CRITICAL
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Scope (S): Changed (C)
        
          Confidentiality (C): High (H)
        
          Integrity (I): Low (L)
        
          Availability (A): Low (L)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): High (H)
        
          Modified Scope (MS): Changed (C)
        
          Modified Integrity (MI): Low (L)
        
          Modified Availability (MA): Low (L)
        
              updated
            
          1 day, 4 hours ago
          by @mweinelt
        
      Activity log
    
              Created suggestion
            
          1 week, 1 day ago
          
          @mweinelt
          
              ignored
            
                8 packages
                calceph
libceph
ceph-csi
ceph-dev
ceph-client
kubectl-rook-ceph
sbclPackages.cephes
haskellPackages.heterocephalus

          1 day, 4 hours ago
          
          @mweinelt
          
              accepted
            
          1 day, 4 hours ago
          
          @mweinelt
          
              published on GitHub
            
          1 day, 4 hours ago
          
            Ceph Monitor subscription handler improperly authorizes config-key store reads, exposing cluster secrets to read-only users
          
      https://github.com/ceph/ceph/security/advisories/GHSA-rg9p-5xcp-wm8h
    
    x_refsource_CONFIRM
  
      https://github.com/ceph/ceph/commit/d971bb2b6199f70b1708a20a63fa944ee7a94727
    
    x_refsource_MISC
  
      https://github.com/ceph/ceph/commit/f2840d2fd338ab5de2865f0f78684bbf7b888c84
    
    x_refsource_MISC
  
    ceph

            ==>= 20.0.0, < 20.2.4
          
            ==>= 19.0.0, < 19.2.6

          Permalink
          
            CVE-2025-30156
          
        8.9 HIGH
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Adjacent (A)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Scope (S): Changed (C)
        
          Confidentiality (C): High (H)
        
          Integrity (I): High (H)
        
          Availability (A): Low (L)
        
          Modified Attack Vector (MAV): Adjacent (A)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): High (H)
        
          Modified Scope (MS): Changed (C)
        
          Modified Integrity (MI): High (H)
        
          Modified Availability (MA): Low (L)
        
              updated
            
          1 day, 4 hours ago
          by @mweinelt
        
      Activity log
    
              Created suggestion
            
          1 week, 1 day ago
          
          @mweinelt
          
              ignored
            
                8 packages
                calceph
libceph
ceph-csi
ceph-dev
ceph-client
kubectl-rook-ceph
sbclPackages.cephes
haskellPackages.heterocephalus

          1 day, 4 hours ago
          
          @mweinelt
          
              accepted
            
          1 day, 4 hours ago
          
          @mweinelt
          
              published on GitHub
            
          1 day, 4 hours ago
          
            Ceph: AES-CBC misuse in CephX and RADOSGW enables authentication bypass and credential forgery
          
      https://github.com/ceph/ceph/security/advisories/GHSA-7q3q-3975-qw3q
    
    x_refsource_CONFIRM
  
      https://github.com/ceph/ceph/commit/2ba086255de09c8b95177717cc7e9dd4377e2f0f
    
    x_refsource_MISC
  
      https://github.com/ceph/ceph/commit/3078188a7bdd89e2975280f2a906c71c2f6effd6
    
    x_refsource_MISC
  
    ceph

            ==< 19.2.6
          
            ==>= 20.0.0, < 20.2.4

          Permalink
          
            CVE-2026-39944
          
        8.8 HIGH
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): High (H)
        
          Integrity (I): High (H)
        
          Availability (A): High (H)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): High (H)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): High (H)
        
          Modified Availability (MA): High (H)
        
              updated
            
          1 day, 4 hours ago
          by @mweinelt
        
      Activity log
    
              Created suggestion
            
          1 week, 1 day ago
          
          @mweinelt
          
              ignored
            
                8 packages
                calceph
libceph
ceph-csi
ceph-dev
ceph-client
kubectl-rook-ceph
sbclPackages.cephes
haskellPackages.heterocephalus

          1 day, 4 hours ago
          
          @mweinelt
          
              accepted
            
          1 day, 4 hours ago
          
          @mweinelt
          
              published on GitHub
            
          1 day, 4 hours ago
          
            Ceph: CephX AES Authentication error
          
      https://github.com/ceph/ceph/security/advisories/GHSA-j73r-qrgx-jvq2
    
    x_refsource_CONFIRM
  
      https://github.com/ceph/ceph/releases/tag/v19.2.6
    
    x_refsource_MISC
  
      https://github.com/ceph/ceph/releases/tag/v20.2.4
    
    x_refsource_MISC
  
    ceph

            ==>= 20.0.0, < 20.2.4
          
            ==>= 19.0.0, < 19.2.6

          Permalink
          
            CVE-2026-54330
          
        8.1 HIGH
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): High (H)
        
          Integrity (I): High (H)
        
          Availability (A): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): High (H)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): High (H)
        
          Modified Availability (MA): None (N)
        
              updated
            
          1 day, 4 hours ago
          by @mweinelt
        
      Activity log
    
              Created suggestion
            
          1 week, 1 day ago
          
          @mweinelt
          
              ignored
            
                8 packages
                calceph
libceph
ceph-csi
ceph-dev
ceph-client
kubectl-rook-ceph
sbclPackages.cephes
haskellPackages.heterocephalus

          1 day, 4 hours ago
          
          @mweinelt
          
              accepted
            
          1 day, 4 hours ago
          
          @mweinelt
          
              published on GitHub
            
          1 day, 4 hours ago
          
            Ceph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalation
          
      https://github.com/ceph/ceph/security/advisories/GHSA-rmjq-ffrm-j6vj
    
    x_refsource_CONFIRM
  
      https://github.com/ceph/ceph/commit/5837aa8e60471128dbb672b0ff6f1b1feebe08a7
    
    x_refsource_MISC
  
      https://github.com/ceph/ceph/commit/5978c866d4a0812fbb024745c4f1e79aaecd6c6a
    
    x_refsource_MISC
  
    ceph

            ==>= 20.0.0, < 20.2.4
          
            ==>= 19.0.0, < 19.2.6

NIXPKGS-2026-2522

GitHub issue published 1 day, 9 hours ago

Grav Admin before 2.0.20 Cross-Site Scripting via marked.js

Permalink CVE-2026-85601

5.1 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): Active (A)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): Low (L)
Subsequent System Impact Integrity (SI): Low (L)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Active (A)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Low (L)
Modified Subsequent System Impact Integrity (MSI): Low (L)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 1 day, 9 hours ago by @LeSuisse Activity log

Created suggestion 1 day, 17 hours ago
@LeSuisse ignored
19 packages
- gravit
- antigravity
- antigravity-cli
- antigravity-fhs
- antigravity-ide
- antigravity-ide-fhs
- stardust-xr-gravity
- kdePackages.libgravatar
- bulwark-plugins.gravatar
- gnomeExtensions.gravatar
- haskellPackages.gravatar
- python313Packages.libgravatar
- python314Packages.libgravatar
- python313Packages.flask-gravatar
- python314Packages.flask-gravatar
- python313Packages.django-gravatar2
- python314Packages.django-gravatar2
- perlPackages.MojoliciousPluginGravatar
- perl5Packages.MojoliciousPluginGravatar
1 day, 9 hours ago
@LeSuisse accepted 1 day, 9 hours ago
@LeSuisse published on GitHub 1 day, 9 hours ago

Grav Admin before 2.0.20 Cross-Site Scripting via marked.js

GitHub Security Advisory (GHSA-752r-88j4-vxm3) vendor-advisory
VulnCheck Advisory: Grav Admin before 2.0.20 Cross-Site Scripting via marked.js third-party-advisory

grav

<2.0.20
==2.0.20

NIXPKGS-2026-2521

GitHub issue published 1 day, 9 hours ago

ConvertX 0.17.0 Arbitrary File Read via LaTeX Input Directives

          Permalink
          
            CVE-2026-85618
          
        7.1 HIGH
      
        CVSS version (CVSS): 4.0
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Attack Requirement (AT): None (N)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Vulnerable System Impact Confidentiality (VC): High (H)
        
          Vulnerable System Impact Integrity (VI): None (N)
        
          Vulnerable System Impact Availability (VA): None (N)
        
          Subsequent System Impact Confidentiality (SC): None (N)
        
          Subsequent System Impact Integrity (SI): None (N)
        
          Subsequent System Impact Availability (SA): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Attack Requirement (MAT): None (N)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Vulnerable System Impact Confidentiality (MVC): High (H)
        
          Modified Vulnerable System Impact Integrity (MVI): None (N)
        
          Modified Vulnerable System Impact Availability (MVA): None (N)
        
          Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
        
          Modified Subsequent System Impact Integrity (MSI): Negligible (N)
        
          Modified Subsequent System Impact Availability (MSA): Negligible (N)
        
          Safety (S): Not Defined (X)
        
          Automatable (AU): Not Defined (X)
        
          Recovery (R): Not Defined (X)
        
          Value Density (V): Not Defined (X)
        
          Vulnerability Response Effort (RE): Not Defined (X)
        
          Provider Urgency (U): Not Defined (X)
        
          Confidentiality Req. (CR): Not Defined (X)
        
          Integrity Req. (IR): Not Defined (X)
        
          Availability Req. (AR): Not Defined (X)
        
          Exploit Maturity (E): Not Defined (X)
        
              updated
            
          1 day, 9 hours ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          1 day, 17 hours ago
          
          @LeSuisse
          
              accepted
            
          1 day, 9 hours ago
          
          @LeSuisse
          
              published on GitHub
            
          1 day, 9 hours ago
          
            ConvertX 0.17.0 Arbitrary File Read via LaTeX Input Directives
          
      GitHub Issue #573
    
    issue-tracking
  
      https://github.com/C4illin/ConvertX
    
    product
  
      https://github.com/C4illin/ConvertX/blob/v0.18.0/src/converters/xelatex.ts
    
    technical-description
  
      VulnCheck Advisory: ConvertX 0.17.0 Arbitrary File Read via LaTeX Input Directives
    
    third-party-advisory
  
    ConvertX

            =<0.18.0
          
            Needs a backport

NIXPKGS-2026-2520

GitHub issue published 1 day, 9 hours ago

ntop nDPI before 6.0 Heap Buffer Overflow via ndpi_json_string_escape

          Permalink
          
            CVE-2026-86098
          
        8.3 HIGH
      
        CVSS version (CVSS): 4.0
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): High (H)
        
          Attack Requirement (AT): Present (P)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): None (N)
        
          Vulnerable System Impact Confidentiality (VC): None (N)
        
          Vulnerable System Impact Integrity (VI): High (H)
        
          Vulnerable System Impact Availability (VA): High (H)
        
          Subsequent System Impact Confidentiality (SC): None (N)
        
          Subsequent System Impact Integrity (SI): None (N)
        
          Subsequent System Impact Availability (SA): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): High (H)
        
          Modified Attack Requirement (MAT): Present (P)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Vulnerable System Impact Confidentiality (MVC): None (N)
        
          Modified Vulnerable System Impact Integrity (MVI): High (H)
        
          Modified Vulnerable System Impact Availability (MVA): High (H)
        
          Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
        
          Modified Subsequent System Impact Integrity (MSI): Negligible (N)
        
          Modified Subsequent System Impact Availability (MSA): Negligible (N)
        
          Safety (S): Not Defined (X)
        
          Automatable (AU): Not Defined (X)
        
          Recovery (R): Not Defined (X)
        
          Value Density (V): Not Defined (X)
        
          Vulnerability Response Effort (RE): Not Defined (X)
        
          Provider Urgency (U): Not Defined (X)
        
          Confidentiality Req. (CR): Not Defined (X)
        
          Integrity Req. (IR): Not Defined (X)
        
          Availability Req. (AR): Not Defined (X)
        
          Exploit Maturity (E): Not Defined (X)
        
              updated
            
          1 day, 9 hours ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          1 day, 17 hours ago
          
          @LeSuisse
          
              accepted
            
          1 day, 9 hours ago
          
          @LeSuisse
          
              published on GitHub
            
          1 day, 9 hours ago
          
            ntop nDPI before 6.0 Heap Buffer Overflow via ndpi_json_string_escape
          
      Patch Commit
    
    patch
  
      https://github.com/ntop/nDPI
    
    product
  
      ndpi_json_string_escape() unbounded writes at release 5.0
    
    technical-description
  
      VulnCheck Advisory: ntop nDPI before 6.0 Heap Buffer Overflow via ndpi_json_string_escape
    
    third-party-advisory
  
    nDPI

            ==6.0
          
            <6.0

NIXPKGS-2026-2519

GitHub issue published 1 day, 9 hours ago

snipe-it before 8.6.3 Authorization Bypass via Bulk Delete

Permalink CVE-2026-85617

8.7 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 1 day, 9 hours ago by @LeSuisse Activity log

Created suggestion 1 day, 17 hours ago
@LeSuisse accepted 1 day, 9 hours ago
@LeSuisse published on GitHub 1 day, 9 hours ago

snipe-it before 8.6.3 Authorization Bypass via Bulk Delete

GitHub Security Advisory (GHSA-mx3g-8v84-j6gg) vendor-advisory
VulnCheck Advisory: snipe-it before 8.6.3 Authorization Bypass via Bulk Delete third-party-advisory

snipe-it

==8.6.3
<8.6.3

NIXPKGS-2026-2518

GitHub issue published 1 day, 9 hours ago

Documenso 2.17.0 PDF Route Ignores Document Visibility

          Permalink
          
            CVE-2026-85697
          
        7.1 HIGH
      
        CVSS version (CVSS): 4.0
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Attack Requirement (AT): None (N)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Vulnerable System Impact Confidentiality (VC): High (H)
        
          Vulnerable System Impact Integrity (VI): None (N)
        
          Vulnerable System Impact Availability (VA): None (N)
        
          Subsequent System Impact Confidentiality (SC): None (N)
        
          Subsequent System Impact Integrity (SI): None (N)
        
          Subsequent System Impact Availability (SA): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Attack Requirement (MAT): None (N)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Vulnerable System Impact Confidentiality (MVC): High (H)
        
          Modified Vulnerable System Impact Integrity (MVI): None (N)
        
          Modified Vulnerable System Impact Availability (MVA): None (N)
        
          Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
        
          Modified Subsequent System Impact Integrity (MSI): Negligible (N)
        
          Modified Subsequent System Impact Availability (MSA): Negligible (N)
        
          Safety (S): Not Defined (X)
        
          Automatable (AU): Not Defined (X)
        
          Recovery (R): Not Defined (X)
        
          Value Density (V): Not Defined (X)
        
          Vulnerability Response Effort (RE): Not Defined (X)
        
          Provider Urgency (U): Not Defined (X)
        
          Confidentiality Req. (CR): Not Defined (X)
        
          Integrity Req. (IR): Not Defined (X)
        
          Availability Req. (AR): Not Defined (X)
        
          Exploit Maturity (E): Not Defined (X)
        
              updated
            
          1 day, 9 hours ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          1 day, 17 hours ago
          
          @LeSuisse
          
              accepted
            
          1 day, 9 hours ago
          
          @LeSuisse
          
              published on GitHub
            
          1 day, 9 hours ago
          
            Documenso 2.17.0 PDF Route Ignores Document Visibility
          
      GitHub Issue #3112
    
    issue-trackingexploit
  
      https://github.com/documenso/documenso
    
    product
  
      https://github.com/documenso/documenso/blob/v2.17.0/apps/remix/server/api/files…
    
    technical-description
  
      VulnCheck Advisory: Documenso 2.17.0 PDF Route Ignores Document Visibility
    
    third-party-advisory
  
    documenso

            =<2.17.0

NIXPKGS-2026-2517

GitHub issue published 1 day, 9 hours ago

Libsoup: libsoup: http/2 client crash in on_data_source_read_callback when settings initial_window_size shrinks during deferred body read

          Permalink
          
            CVE-2026-85534
          
        5.9 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): High (H)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): None (N)
        
          Integrity (I): None (N)
        
          Availability (A): High (H)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): High (H)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): None (N)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): High (H)
        
              updated
            
          1 day, 9 hours ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          1 day, 17 hours ago
          
          @LeSuisse
          
              accepted
            
          1 day, 9 hours ago
          
          @LeSuisse
          
              published on GitHub
            
          1 day, 9 hours ago
          
            Libsoup: libsoup: http/2 client crash in on_data_source_read_callback when settings initial_window_size shrinks during deferred body read
          
      https://access.redhat.com/security/cve/CVE-2026-85534
    
    vdb-entryx_refsource_REDHAT
  
      RHBZ#2528440
    
    issue-trackingx_refsource_REDHAT
  
      https://gitlab.gnome.org/GNOME/libsoup/-/blob/master/libsoup/http2/soup-client-…
    
      https://gitlab.gnome.org/GNOME/libsoup/-/work_items/551
    
    libsoup

    libsoup3

            Patch:https://gitlab.gnome.org/GNOME/libsoup/-/commit/5f656cd97b8a6f4a5b8b7a30efb7c2cc8ef498fb

NIXPKGS-2026-2516

GitHub issue published 1 day, 9 hours ago

tokenizers BpeBuilder Buffer Overflow via merge token

          Permalink
          
            CVE-2026-85670
          
        7.1 HIGH
      
        CVSS version (CVSS): 4.0
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Attack Requirement (AT): None (N)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): Passive (P)
        
          Vulnerable System Impact Confidentiality (VC): None (N)
        
          Vulnerable System Impact Integrity (VI): None (N)
        
          Vulnerable System Impact Availability (VA): High (H)
        
          Subsequent System Impact Confidentiality (SC): None (N)
        
          Subsequent System Impact Integrity (SI): None (N)
        
          Subsequent System Impact Availability (SA): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Attack Requirement (MAT): None (N)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): Passive (P)
        
          Modified Vulnerable System Impact Confidentiality (MVC): None (N)
        
          Modified Vulnerable System Impact Integrity (MVI): None (N)
        
          Modified Vulnerable System Impact Availability (MVA): High (H)
        
          Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
        
          Modified Subsequent System Impact Integrity (MSI): Negligible (N)
        
          Modified Subsequent System Impact Availability (MSA): Negligible (N)
        
          Safety (S): Not Defined (X)
        
          Automatable (AU): Not Defined (X)
        
          Recovery (R): Not Defined (X)
        
          Value Density (V): Not Defined (X)
        
          Vulnerability Response Effort (RE): Not Defined (X)
        
          Provider Urgency (U): Not Defined (X)
        
          Confidentiality Req. (CR): Not Defined (X)
        
          Integrity Req. (IR): Not Defined (X)
        
          Availability Req. (AR): Not Defined (X)
        
          Exploit Maturity (E): Not Defined (X)
        
              updated
            
          1 day, 9 hours ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          1 day, 17 hours ago
          
          @LeSuisse
          
              ignored
            
                8 packages
                openvino-tokenizers
python313Packages.curated-tokenizers
python313Packages.pytorch-tokenizers
python314Packages.curated-tokenizers
python314Packages.pytorch-tokenizers
python313Packages.openvino-tokenizers
python314Packages.openvino-tokenizers
pkgsRocm.python3Packages.pytorch-tokenizers

          1 day, 9 hours ago
          
          @LeSuisse
          
              accepted
            
          1 day, 9 hours ago
          
          @LeSuisse
          
              published on GitHub
            
          1 day, 9 hours ago
          
            tokenizers BpeBuilder Buffer Overflow via merge token
          
      GitHub Issue #2094
    
    issue-trackingexploit
  
      https://github.com/huggingface/tokenizers
    
    product
  
      https://github.com/huggingface/tokenizers/blob/v0.23.2/tokenizers/src/models/bp…
    
    technical-description
  
      VulnCheck Advisory: tokenizers BpeBuilder Buffer Overflow via merge token
    
    third-party-advisory
  
    tokenizers

            =<0.23.2

Nixpkgs security tracker

Published issues

abort() in libpcap before 1.10.7 on an invalid BPF opcode

OOBR and OOBW in libpcap before 1.10.7

OOBR in rpcap client in libpcap before 1.10.7

infinte loop in libpcap before 1.10.7

OOBR in libpcap before 1.10.7

division by zero in libpcap before 1.10.7

rpcapd memory leak in libpcap before 1.10.7

In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback …

In libxml2 before 2.15.4, there is a heap-based buffer overflow …

In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer …

In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do …

In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer …

xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference …

In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka …

In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat …

Ceph Monitor subscription handler improperly authorizes config-key store reads, exposing cluster secrets to read-only users

Ceph: AES-CBC misuse in CephX and RADOSGW enables authentication bypass and credential forgery

Ceph: CephX AES Authentication error

Ceph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalation

Grav Admin before 2.0.20 Cross-Site Scripting via marked.js

ConvertX 0.17.0 Arbitrary File Read via LaTeX Input Directives

ntop nDPI before 6.0 Heap Buffer Overflow via ndpi_json_string_escape

snipe-it before 8.6.3 Authorization Bypass via Bulk Delete

Documenso 2.17.0 PDF Route Ignores Document Visibility

Libsoup: libsoup: http/2 client crash in on_data_source_read_callback when settings initial_window_size shrinks during deferred body read

tokenizers BpeBuilder Buffer Overflow via merge token