NIXPKGS-2026-1884

GitHub issue published 3 months ago

Samba: denial of service against ad dc wins server

Permalink CVE-2026-3238

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse ignored package sambamba 3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse ignored maintainer @aneeshusa 3 months ago maintainer.ignore
• @LeSuisse published on GitHub 3 months ago

Samba: denial of service against ad dc wins server

• https://access.redhat.com/security/cve/CVE-2026-3238 x_refsource_REDHATvdb-entry
• RHBZ#2486176 x_refsource_REDHATissue-tracking
• https://www.samba.org/samba/security/CVE-2026-3238.html

---

rhcos

samba

samba4

NIXPKGS-2026-1883

GitHub issue published 3 months ago

Routinator: 0.15.2 security release

Permalink CVE-2026-49234

8.2 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): High (H)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

Routinator crashes on specifically crafted ASN strings in the API

• https://www.nlnetlabs.nl/downloads/routinator/CVE-2026-49234.txt vendor-advisory

---

Routinator

• *

Permalink CVE-2026-49233

8.3 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

Routinator cache path traversal using rogue rsync URIs

• https://www.nlnetlabs.nl/downloads/routinator/CVE-2026-49233.txt vendor-advisory

---

Routinator

• *

Permalink CVE-2026-49232

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Low (L)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

Routinator exits when accepting an incoming HTTP or RTR connection fails

• https://www.nlnetlabs.nl/downloads/routinator/CVE-2026-49232.txt vendor-advisory

---

Routinator

• *

Permalink CVE-2026-49235

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Low (L)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

Routinator crashes on specifically crafted RRDP XML files

• https://www.nlnetlabs.nl/downloads/routinator/CVE-2026-49235.txt vendor-advisory

---

Routinator

• *

NIXPKGS-2026-1882

GitHub issue published 3 months ago

OpenVPN CVE-2026-40215 and CVE-2026-35058

Permalink CVE-2026-40215

6.1 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Low (L)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse ignored
  6 packages

  • openvpn3
  • openvpn-auth-ldap
  • namespaced-openvpn
  • openvpn_learnaddress
  • networkmanager-openvpn
  • nagiosPlugins.check_openvpn
  3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 …

• https://community.openvpn.net/Security%20Announcements/CVE-2026-40215 vendor-advisory
• https://community.openvpn.net/ReleaseHistory#openvpn-272-released-22-april-2026 release-notes
• https://community.openvpn.net/ReleaseHistory#openvpn-2620-released-22-april-2026 release-notes

---

OpenVPN

• =<2.7.1
• =<2.6.19

Permalink CVE-2026-35058

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): High (H)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse ignored
  6 packages

  • openvpn3
  • openvpn-auth-ldap
  • namespaced-openvpn
  • openvpn_learnaddress
  • networkmanager-openvpn
  • nagiosPlugins.check_openvpn
  3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

Improper validation of packet length during tls-crypt-v2 key extraction in …

• https://community.openvpn.net/Security%20Announcements/CVE-2026-35058 vendor-advisory
• https://community.openvpn.net/ReleaseHistory#openvpn-272-released-22-april-2026 release-notes
• https://community.openvpn.net/ReleaseHistory#openvpn-2620-released-22-april-2026 release-notes
• https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2381

---

OpenVPN

• =<2.7.1
• =<2.6.19

NIXPKGS-2026-1881

GitHub issue published 3 months, 1 week ago

USCiLab Cereal Shared Pointer type confusion

Permalink CVE-2026-11463

2.9 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 3 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 3 months, 1 week ago
• @LeSuisse ignored
  16 packages

  • haskellPackages.cereal
  • haskellPackages.cereal-unordered-containers
  • haskellPackages.cereal-conduit
  • typstPackages.cereal-words_0_1_0
  • haskellPackages.safe-money-cereal
  • haskellPackages.histogram-fill-cereal
  • haskellPackages.mpi-hs-cereal
  • haskellPackages.leb128-cereal
  • haskellPackages.exinst-cereal
  • haskellPackages.domain-cereal
  • haskellPackages.genvalidity-hspec-cereal
  • haskellPackages.cereal-vector
  • haskellPackages.cereal-time
  • haskellPackages.cereal-text
  • pkgsRocm.haskellPackages.mpi-hs-cereal
  • typstPackages.cereal-words
  3 months, 1 week ago
• @LeSuisse ignored
  4 references

  • https://github.com/USCiLab/cereal/
  • CVE-2026-11463 | CVE Analysis and Report
  • Submit #814456 | USCiLab cereal 1.3.2 C…
  • VDB-369083 | CTI Indicators (IOB, IOC)
  3 months, 1 week ago
• @LeSuisse accepted 3 months, 1 week ago
• @LeSuisse published on GitHub 3 months, 1 week ago

USCiLab Cereal Shared Pointer type confusion

• VDB-369083 | USCiLab Cereal Shared Pointer type confusion vdb-entry
• https://github.com/USCiLab/cereal/issues/870 issue-tracking
• https://gist.github.com/TrebledJ/0223c1fa3c3fd64e2c7047b8a4385ec0 exploit

Ignored references (4)

• VDB-369083 | CTI Indicators (IOB, IOC) permissions-requiredsignature
• CVE-2026-11463 | CVE Analysis and Report third-party-advisory
• Submit #814456 | USCiLab cereal 1.3.2 CWE-1287, CWE-843 (Type Confusion) third-party-advisory
• https://github.com/USCiLab/cereal/ product

---

Cereal

• ==1.3.1
• ==1.3.0
• ==1.3.2

NIXPKGS-2026-1880

GitHub issue published 3 months, 1 week ago

Protocol::HTTP2 versions through 1.12 for Perl is vulnerable to a HTTP/2 Bomb

Permalink CVE-2026-10725

updated 3 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 3 months, 1 week ago
• @LeSuisse accepted 3 months, 1 week ago
• @LeSuisse published on GitHub 3 months, 1 week ago

Protocol::HTTP2 versions through 1.12 for Perl is vulnerable to a HTTP/2 Bomb

• https://metacpan.org/release/CRUX/Protocol-HTTP2-1.12/source/lib/Protocol/HTTP2…
• https://metacpan.org/release/CRUX/Protocol-HTTP2-1.12/source/lib/Protocol/HTTP2…
• https://security.metacpan.org/patches/P/Protocol-HTTP2/1.12/CVE-2026-10725-r1.p… patch
• http://www.openwall.com/lists/oss-security/2026/06/06/7

---

Protocol-HTTP2

• =<1.12

NIXPKGS-2026-1879

GitHub issue published 3 months, 1 week ago

Graphite before 1.3.15 has an integer underflow and resultant out-of-bounds …

Permalink CVE-2026-50593

7.3 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 3 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 3 months, 1 week ago
• @LeSuisse ignored
  8 packages

  • graphite
  • graphite-cursors
  • graphite-gtk-theme
  • prometheus-graphite-exporter
  • python314Packages.graphite-web
  • python313Packages.graphite-web
  • haskellPackages.graphite
  • graphite-cli
  3 months, 1 week ago
• @LeSuisse accepted 3 months, 1 week ago
• @LeSuisse published on GitHub 3 months, 1 week ago

Graphite before 1.3.15 has an integer underflow and resultant out-of-bounds …

• https://github.com/silnrsi/graphite/commit/ad78c6b7319909e1540c1b134e115ced0341…
• https://github.com/silnrsi/graphite/compare/1.3.14...1.3.15

---

Graphite

• <1.3.15

NIXPKGS-2026-1878

GitHub issue published 3 months, 1 week ago

Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix

Permalink CVE-2026-45409

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 3 months, 1 week ago
• @LeSuisse ignored
  4 packages

  • sbclPackages.idna
  • echidna
  • kodiPackages.idna
  • unicode-idna
  3 months, 1 week ago
• @LeSuisse accepted 3 months, 1 week ago
• @LeSuisse published on GitHub 3 months, 1 week ago

Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix

• https://github.com/kjd/idna/security/advisories/GHSA-65pc-fj4g-8rjx x_refsource_CONFIRM

---

idna

• ==< 3.15

NIXPKGS-2026-1877

GitHub issue published 3 months, 1 week ago

Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification

Permalink CVE-2026-47707

5.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 3 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 3 months, 1 week ago
• @LeSuisse ignored
  3 packages

  • strawberry
  • python313Packages.strawberry-django
  • pkgsRocm.python3Packages.strawberry-django
  3 months, 1 week ago
• @LeSuisse accepted 3 months, 1 week ago
• @LeSuisse published on GitHub 3 months, 1 week ago

Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification

• https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-fr49-mhgj-crfc exploitx_refsource_CONFIRM
• https://github.com/strawberry-graphql/strawberry/releases/tag/0.315.7 x_refsource_MISC

---

strawberry

• ==>= 0.172.0, < 0.315.7

NIXPKGS-2026-1876

GitHub issue published 3 months, 1 week ago

Out-of-bounds read vulnerability in Samsung Open Source rlottie allows Overread …

Permalink CVE-2026-10305

6.1 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): High (H)

updated 3 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 3 months, 1 week ago
• @LeSuisse ignored package libsForQt5.rlottie-qml 3 months, 1 week ago
• @LeSuisse accepted 3 months, 1 week ago
• @LeSuisse published on GitHub 3 months, 1 week ago

Out-of-bounds read vulnerability in Samsung Open Source rlottie allows Overread …

• https://github.com/Samsung/rlottie/pull/587

---

rlottie

• ==223a2a41ba4f462e4abe767bebba49a366c9b9fd

NIXPKGS-2026-1875

GitHub issue published 3 months, 1 week ago

In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped …

Permalink CVE-2026-50292

7.4 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 3 months, 1 week ago by @LeSuisse Activity log

• Created suggestion 3 months, 1 week ago
• @LeSuisse ignored
  5 packages

  • gebaar-libinput
  • libinput-gestures
  • xf86inputlibinput
  • xf86-input-libinput
  • xlibinput-calibrator
  3 months, 1 week ago
• @LeSuisse accepted 3 months, 1 week ago
• @LeSuisse ignored maintainer @jtojnar 3 months, 1 week ago maintainer.ignore
• @LeSuisse published on GitHub 3 months, 1 week ago

In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped …

• https://gitlab.freedesktop.org/libinput/libinput/-/work_items/1296 exploit
• https://gitlab.freedesktop.org/libinput/libinput/-/commit/76f0d8a7f57e286888286…
• https://www.openwall.com/lists/oss-security/2026/06/04/5

---

libinput

• <1.31.3
• <1.30.4