NIXPKGS-2026-2659

GitHub issue published 7 hours ago

OpenImageIO: Segmentation Fault in BmpInput::read_native_scanline (bmpinput.cpp:399)

Permalink CVE-2026-50291

5.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 7 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse accepted 8 hours ago
• @LeSuisse published on GitHub 7 hours ago

OpenImageIO: Segmentation Fault in BmpInput::read_native_scanline (bmpinput.cpp:399)

• https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-q3c7-3225-66h7 x_refsource_CONFIRM
• https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5030 x_refsource_MISC
• https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/91500ed58ce927b7e710c6bbc3b7f795bb0791b5 x_refsource_MISC
• https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/be984856e315e0a82cd866745b544c8c4cb8bd45 x_refsource_MISC
• https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/ee3370d004d5895554239b4302c59eedb721f086 x_refsource_MISC
• https://github.com/AcademySoftwareFoundation/OpenImageIO/releases/tag/v3.0.16.0 x_refsource_MISC
• https://github.com/AcademySoftwareFoundation/OpenImageIO/releases/tag/v3.1.11.0 x_refsource_MISC

---

OpenImageIO

• ==>= 3.1.0.0, < 3.1.11.0
• ==< 3.0.16.0

Needs something for stable.

NIXPKGS-2026-2658

GitHub issue published 7 hours ago

Assertion failure in the DNS stub resolver with a long search domain

Permalink CVE-2026-8674

5.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Adjacent (A)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Adjacent (A)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 7 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse ignored
  17 packages

  • libc
  • iconv
  • getent
  • locale
  • mtrace
  • getconf
  • libiconv
  • glibcInfo
  • glibc_multi
  • glibcLocales
  • glibc_memusage
  • glibcLocalesUtf8
  • unixtools.getent
  • unixtools.locale
  • unixtools.getconf
  • minimal-bootstrap.glibc
  • minimal-bootstrap.glibc-headers
  8 hours ago
• @LeSuisse accepted 8 hours ago
• @LeSuisse published on GitHub 7 hours ago

Assertion failure in the DNS stub resolver with a long search domain

• https://sourceware.org/bugzilla/show_bug.cgi?id=31026 issue-tracking
• https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026… vendor-advisory
• https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246… patch
• https://joshua.hu/fuzzing-glibc-libresolv technical-description
• http://www.openwall.com/lists/oss-security/2026/09/17/4

---

glibc

• =<2.44

NIXPKGS-2026-2657

GitHub issue published 7 hours ago

vgmstream EA SCHl parser vadpcm_decoder.c vadpcm_read_coefs_be out-of-bounds write

Permalink CVE-2026-92880

5.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): Not Defined (X)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 7 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse ignored package deadbeefPlugins.vgmstream 8 hours ago
• @LeSuisse accepted 8 hours ago
• @LeSuisse published on GitHub 7 hours ago

vgmstream EA SCHl parser vadpcm_decoder.c vadpcm_read_coefs_be out-of-bounds write

• VDB-406346 | vgmstream EA SCHl parser vadpcm_decoder.c vadpcm_read_coefs_be out-of-bounds write technical-descriptionvdb-entry
• VDB-406346 | CTI Indicators (IOB, IOC, IOA) permissions-requiredsignature
• CVE-2026-92880 | CVE Analysis and Report third-party-advisory
• Submit #942161 | vgmstream r2117 Buffer Overflow third-party-advisory
• https://github.com/vgmstream/vgmstream/issues/1994 issue-tracking
• https://github.com/vgmstream/vgmstream/pull/2008 issue-trackingpatch
• https://github.com/vgmstream/vgmstream/commit/ae37662ad626254ddd96ad69ac263792d… patch
• https://github.com/vgmstream/vgmstream/ product

---

vgmstream

• ==r2117

NIXPKGS-2026-2656

GitHub issue published 7 hours ago

NetworkManager-l2tp Privilege Escalation via pppd Plugin Injection

Permalink CVE-2026-93337

8.5 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 7 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse accepted 8 hours ago
• @LeSuisse published on GitHub 7 hours ago

NetworkManager-l2tp Privilege Escalation via pppd Plugin Injection

• GitHub Security Advisory (GHSA-rp84-8h2r-5xc3) vendor-advisory
• Patch Commit patch
• https://www.vulncheck.com/advisories/networkmanager-l2tp-privilege-escalation-v… third-party-advisory

---

NetworkManager-l2tp

• =<1.52.4

NIXPKGS-2026-2655

GitHub issue published 7 hours ago

Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors)

Permalink CVE-2026-85999

5.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 7 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse accepted 8 hours ago
• @LeSuisse published on GitHub 7 hours ago

Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors)

• https://github.com/facelessuser/soupsieve/security/advisories/GHSA-j934-xhv5-fg8f x_refsource_CONFIRM
• https://github.com/facelessuser/soupsieve/commit/cf198fcddc9230f06ed39f974eba0ce076b85cda x_refsource_MISC
• https://github.com/facelessuser/soupsieve/releases/tag/2.9 x_refsource_MISC

---

soupsieve

• ==< 2.9

NIXPKGS-2026-2654

GitHub issue published 7 hours ago

Valhalla: Degenerate exclude_polygons (collinear points, zero area) causes OOM in /sources_to_targets

Permalink CVE-2026-54716

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 7 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse ignored
  2 packages

  • python313Packages.valhallaapi
  • python314Packages.valhallaapi
  8 hours ago
• @LeSuisse accepted 8 hours ago
• @LeSuisse published on GitHub 7 hours ago

Valhalla: Degenerate exclude_polygons (collinear points, zero area) causes OOM in /sources_to_targets

• https://github.com/valhalla/valhalla/security/advisories/GHSA-qpf6-xp29-pg6r x_refsource_CONFIRM

---

valhalla

• ==<= 3.7.0

Needs something for stable

NIXPKGS-2026-2653

GitHub issue published 7 hours ago

MariaDB Connector/J does not enforce allowLocalInfile=false on server-initiated LOCAL INFILE requests

Permalink CVE-2026-61700

3.7 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 7 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse accepted 8 hours ago
• @LeSuisse published on GitHub 7 hours ago

MariaDB Connector/J does not enforce allowLocalInfile=false on server-initiated LOCAL INFILE requests

• https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-wxmm-q36w-r9xj x_refsource_CONFIRM
• https://github.com/mariadb-corporation/mariadb-connector-j/commit/0205d8be947918566cd9ce5a9db149541bbc8dee x_refsource_MISC
• https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.9 x_refsource_MISC

---

mariadb-connector-j

• ==>= 3.0.0, < 3.3.5
• ==>= 3.4.0, < 3.4.3
• ==>= 3.5.0, < 3.5.9
• ==< 2.7.14

Needs a backport.

NIXPKGS-2026-2652

GitHub issue published 7 hours ago

vgmstream mus_acm.c parse_mus resource consumption

Permalink CVE-2026-92879

5.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): Not Defined (X)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 7 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse ignored package deadbeefPlugins.vgmstream 8 hours ago
• @LeSuisse ignored reference https://g… 8 hours ago
• @LeSuisse accepted 8 hours ago
• @LeSuisse published on GitHub 7 hours ago

vgmstream mus_acm.c parse_mus resource consumption

• VDB-406345 | vgmstream mus_acm.c parse_mus resource consumption technical-descriptionvdb-entry
• VDB-406345 | CTI Indicators (IOB, IOC, TTP, IOA) permissions-requiredsignature
• CVE-2026-92879 | CVE Analysis and Report third-party-advisory
• Submit #942160 | vgmstream r2117 Resource Consumption third-party-advisory
• https://github.com/vgmstream/vgmstream/issues/1993 issue-tracking
• https://github.com/vgmstream/vgmstream/pull/2008 issue-trackingpatch
• https://github.com/vgmstream/vgmstream/commit/ae37662ad626254ddd96ad69ac263792d… patch

Ignored references (1)

• https://github.com/vgmstream/vgmstream/ product

---

vgmstream

• ==r2117

NIXPKGS-2026-2651

GitHub issue published 7 hours ago

vLLM through 0.29.0 Memory Exhaustion via Rejected Requests

Permalink CVE-2026-93436

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 7 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse accepted 8 hours ago
• @LeSuisse published on GitHub 7 hours ago

vLLM through 0.29.0 Memory Exhaustion via Rejected Requests

• https://github.com/vllm-project/vllm/pull/55677 issue-trackingpatch
• https://github.com/vllm-project/vllm/blob/v0.29.0/vllm/distributed/kv_transfer/… technical-description
• https://github.com/vllm-project/vllm product
• VulnCheck Advisory: vLLM through 0.29.0 Memory Exhaustion via Rejected Requests third-party-advisory

---

vllm

• =<0.29.0

NIXPKGS-2026-2650

GitHub issue published 7 hours ago

vgmstream AWB parser awb.c init_vgmstream_awb_memory divide by zero

Permalink CVE-2026-92881

5.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): Not Defined (X)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 7 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse ignored reference https://g… 8 hours ago
• @LeSuisse ignored package deadbeefPlugins.vgmstream 8 hours ago
• @LeSuisse accepted 8 hours ago
• @LeSuisse published on GitHub 7 hours ago

vgmstream AWB parser awb.c init_vgmstream_awb_memory divide by zero

• VDB-406347 | vgmstream AWB parser awb.c init_vgmstream_awb_memory divide by zero technical-descriptionvdb-entry
• VDB-406347 | CTI Indicators (IOB, IOC, TTP, IOA) permissions-requiredsignature
• CVE-2026-92881 | CVE Analysis and Report third-party-advisory
• Submit #942165 | vgmstream r2117 Divide by Zero third-party-advisory
• https://github.com/vgmstream/vgmstream/issues/1996 issue-tracking
• https://github.com/vgmstream/vgmstream/pull/2008 issue-trackingpatch
• https://github.com/vgmstream/vgmstream/commit/ae37662ad626254ddd96ad69ac263792d… patch

Ignored references (1)

• https://github.com/vgmstream/vgmstream/ product

---

vgmstream

• ==n/a