Nixpkgs security tracker

Login with GitHub

Published issues

All published security issues are tracked and resolved on GitHub.

NIXPKGS-2026-1879
published 5 hours ago
Graphite before 1.3.15 has an integer underflow and resultant out-of-bounds …
Permalink CVE-2026-50593
7.3 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
updated 5 hours ago by @LeSuisse Activity log
  • Created suggestion 10 hours ago
  • @LeSuisse ignored
    8 packages
    • graphite
    • graphite-cursors
    • graphite-gtk-theme
    • prometheus-graphite-exporter
    • python314Packages.graphite-web
    • python313Packages.graphite-web
    • haskellPackages.graphite
    • graphite-cli
    5 hours ago
  • @LeSuisse accepted 5 hours ago
  • @LeSuisse published on GitHub 5 hours ago

Graphite before 1.3.15 has an integer underflow and resultant out-of-bounds …

Graphite
  • <1.3.15
NIXPKGS-2026-1878
published 5 hours ago
Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix
Permalink CVE-2026-45409
6.9 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): Low (L)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): Low (L)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 5 hours ago by @LeSuisse Activity log
  • Created suggestion 10 hours ago
  • @LeSuisse ignored
    4 packages
    • sbclPackages.idna
    • echidna
    • kodiPackages.idna
    • unicode-idna
    5 hours ago
  • @LeSuisse accepted 5 hours ago
  • @LeSuisse published on GitHub 5 hours ago

Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix

idna
  • ==< 3.15
NIXPKGS-2026-1877
published 1 day, 5 hours ago
Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification
Permalink CVE-2026-47707
5.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): Low (L)
updated 1 day, 5 hours ago by @LeSuisse Activity log
  • Created suggestion 1 day, 10 hours ago
  • @LeSuisse ignored
    3 packages
    • strawberry
    • python313Packages.strawberry-django
    • pkgsRocm.python3Packages.strawberry-django
    1 day, 6 hours ago
  • @LeSuisse accepted 1 day, 6 hours ago
  • @LeSuisse published on GitHub 1 day, 5 hours ago

Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification

strawberry
  • ==>= 0.172.0, < 0.315.7
NIXPKGS-2026-1876
published 1 day, 5 hours ago
Out-of-bounds read vulnerability in Samsung Open Source rlottie allows Overread …
Permalink CVE-2026-10305
6.1 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): Low (L)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): High (H)
updated 1 day, 5 hours ago by @LeSuisse Activity log
  • Created suggestion 1 day, 10 hours ago
  • @LeSuisse ignored package libsForQt5.rlottie-qml 1 day, 6 hours ago
  • @LeSuisse accepted 1 day, 6 hours ago
  • @LeSuisse published on GitHub 1 day, 5 hours ago

Out-of-bounds read vulnerability in Samsung Open Source rlottie allows Overread …

rlottie
  • ==223a2a41ba4f462e4abe767bebba49a366c9b9fd
NIXPKGS-2026-1875
published 1 day, 5 hours ago
In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped …
Permalink CVE-2026-50292
7.4 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
updated 1 day, 5 hours ago by @LeSuisse Activity log
  • Created suggestion 1 day, 10 hours ago
  • @LeSuisse ignored
    5 packages
    • gebaar-libinput
    • libinput-gestures
    • xf86inputlibinput
    • xf86-input-libinput
    • xlibinput-calibrator
    1 day, 6 hours ago
  • @LeSuisse accepted 1 day, 6 hours ago
  • @LeSuisse ignored maintainer @jtojnar 1 day, 5 hours ago maintainer.ignore
  • @LeSuisse published on GitHub 1 day, 5 hours ago

In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped …

libinput
  • <1.31.3
  • <1.30.4
NIXPKGS-2026-1874
published 1 day, 5 hours ago
LIBPNG: Chunk smuggling in push-mode APNG parser via unconsumed chunk body
Permalink CVE-2026-40930
5.4 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): Low (L)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): Low (L)
updated 1 day, 5 hours ago by @LeSuisse Activity log
  • Created suggestion 1 day, 10 hours ago
  • @LeSuisse ignored
    3 packages
    • libpng12
    • perlPackages.ImagePNGLibpng
    • perl5Packages.ImagePNGLibpng
    1 day, 6 hours ago
  • @LeSuisse accepted 1 day, 6 hours ago
  • @LeSuisse published on GitHub 1 day, 5 hours ago

LIBPNG: Chunk smuggling in push-mode APNG parser via unconsumed chunk body

libpng
  • === 1.8.0
libpng-apng
  • ==>= 1.6.49, <= 1.6.57
NIXPKGS-2026-1873
published 1 day, 5 hours ago
HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities
Permalink CVE-2026-8829
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 1 day, 5 hours ago by @LeSuisse Activity log
  • Created suggestion 1 day, 10 hours ago
  • @LeSuisse ignored
    2 packages
    • akkuPackages.chibi-html-parser
    • chickenPackages_5.chickenEggs.html-parser
    1 day, 6 hours ago
  • @LeSuisse accepted 1 day, 6 hours ago
  • @LeSuisse published on GitHub 1 day, 5 hours ago

HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities

HTML-Parser
  • <3.84
NIXPKGS-2026-1872
published 1 day, 5 hours ago
zilliztech GPTCache Cache Key pre.py BufferedReader.peek weak hash
Permalink CVE-2026-10812
1.1 LOW
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): High (H)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): Low (L)
  • Vulnerable System Impact Availability (VA): Low (L)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Exploit Maturity (E): POC (P)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): Low (L)
  • Modified Vulnerable System Impact Availability (MVA): Low (L)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
updated 1 day, 5 hours ago by @LeSuisse Activity log

zilliztech GPTCache Cache Key pre.py BufferedReader.peek weak hash

GPTCache
  • ==0.1.34
  • ==0.1.33
  • ==0.1.31
  • ==0.1.5
  • ==0.1.9
  • ==0.1.6
  • ==0.1.19
  • ==0.1.28
  • ==0.1.13
  • ==0.1.25
  • ==0.1.20
  • ==0.1.16
  • ==0.1.42
  • ==0.1.2
  • ==0.1.18
  • ==0.1.23
  • ==0.1.7
  • ==0.1.11
  • ==0.1.8
  • ==0.1.0
  • ==0.1.1
  • ==0.1.38
  • ==0.1.37
  • ==0.1.27
  • ==0.1.29
  • ==0.1.4
  • ==0.1.30
  • ==0.1.14
  • ==0.1.22
  • ==0.1.36
  • ==0.1.35
  • ==0.1.41
  • ==0.1.21
  • ==0.1.17
  • ==0.1.26
  • ==0.1.10
  • ==0.1.24
  • ==0.1.12
  • ==0.1.40
  • ==0.1.3
  • ==0.1.43
  • ==0.1.44
  • ==0.1.15
  • ==0.1.39
  • ==0.1.32
NIXPKGS-2026-1871
published 1 day, 5 hours ago
Net::Statsd versions before 0.13 for Perl allow metric injections
Permalink CVE-2026-46739
5.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated 1 day, 5 hours ago by @LeSuisse Activity log
  • Created suggestion 1 day, 10 hours ago
  • @LeSuisse accepted 1 day, 5 hours ago
  • @LeSuisse published on GitHub 1 day, 5 hours ago

Net::Statsd versions before 0.13 for Perl allow metric injections

Net-Statsd
  • <0.13
NIXPKGS-2026-1870
published 1 day, 5 hours ago
Networkmanager: networkmanager: local privilege escalation via malformed mud urls in dhclient backend
Permalink CVE-2026-10805
6.7 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
updated 1 day, 5 hours ago by @LeSuisse Activity log
  • Created suggestion 1 day, 10 hours ago
  • @LeSuisse ignored
    20 packages
    • networkmanager-ssh
    • networkmanager_strongswan
    • networkmanager-fortisslvpn
    • networkmanager-openconnect
    • kdePackages.networkmanager-qt
    • mobile-broadband-provider-info
    • python313Packages.sdbus-networkmanager
    • python314Packages.sdbus-networkmanager
    • haskellPackages.amazonka-networkmanager
    • python313Packages.mypy-boto3-networkmanager
    • python314Packages.mypy-boto3-networkmanager
    • python313Packages.types-aiobotocore-networkmanager
    • networkmanager-vpnc
    • networkmanager_dmenu
    • networkmanager-iodine
    • networkmanager-openvpn
    • networkmanager-strongswan
    • networkmanager-sstp
    • networkmanagerapplet
    • networkmanager-l2tp
    1 day, 5 hours ago
  • @LeSuisse accepted 1 day, 5 hours ago
  • @LeSuisse published on GitHub 1 day, 5 hours ago

Networkmanager: networkmanager: local privilege escalation via malformed mud urls in dhclient backend

NetworkManager
networkmanager
network-manager-applet
NetworkManager-openswan
NetworkManager-libreswan
mobile-broadband-provider-info
redhat-user-workloads/art-images
openshift4/ose-ovn-kubernetes-rhel9
openshift4/kubernetes-nmstate-rhel8-operator
openshift4/kubernetes-nmstate-rhel9-operator
openshift4/ose-ovn-kubernetes-microshift-rhel9
openshift4/ose-kubernetes-nmstate-handler-rhel8
openshift4/ose-kubernetes-nmstate-handler-rhel9
openshift4/ose-aws-cluster-api-controllers-rhel8
openshift4/ose-aws-cluster-api-controllers-rhel9
multicluster-engine/cluster-api-provider-aws-rhel9