NIXPKGS-2026-1246

GitHub issue published 2 months ago

Permalink CVE-2026-33261

5.9 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 2 months ago by @LeSuisse Activity log

Created suggestion 2 months ago
@LeSuisse ignored package rotp 2 months ago
@LeSuisse accepted 2 months ago
@LeSuisse published on GitHub 2 months ago

Null pointer accces in aggressive NSEC(3) cache

https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerd…

pdns-recursor

<5.2.9
<5.4.1
<5.3.6

NIXPKGS-2026-1245

GitHub issue published 2 months ago

Permalink CVE-2026-33602

6.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): High (H)

updated 2 months ago by @LeSuisse Activity log

Created suggestion 2 months ago
@LeSuisse accepted 2 months ago
@LeSuisse published on GitHub 2 months ago

Off-by-one access when processing crafted UDP responses

https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-…

dnsdist

<2.0.4
<1.9.13

NIXPKGS-2026-1244

GitHub issue published 2 months ago

Permalink CVE-2026-33258

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

updated 2 months ago by @LeSuisse Activity log

Created suggestion 2 months ago
@LeSuisse ignored package rotp 2 months ago
@LeSuisse accepted 2 months ago
@LeSuisse published on GitHub 2 months ago

Crafted zones can cause increased resource usage

https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerd…

pdns-recursor

<5.2.9
<5.4.1
<5.3.6

NIXPKGS-2026-1243

GitHub issue published 2 months ago

Permalink CVE-2026-33254

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

updated 2 months ago by @LeSuisse Activity log

Created suggestion 2 months ago
@LeSuisse accepted 2 months ago
@LeSuisse published on GitHub 2 months ago

Resource exhaustion via DoQ/DoH3 connections

https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-…

dnsdist

<2.0.4
<1.9.13

NIXPKGS-2026-1242

GitHub issue published 2 months ago

Permalink CVE-2026-33593

7.5 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 2 months ago by @LeSuisse Activity log

Created suggestion 2 months ago
@LeSuisse accepted 2 months ago
@LeSuisse published on GitHub 2 months ago

Denial of service via crafted DNSCrypt query

https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-…

dnsdist

<2.0.4
<1.9.13

NIXPKGS-2026-1241

GitHub issue published 2 months ago

Permalink CVE-2026-33601

4.4 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): High (H)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 2 months ago by @LeSuisse Activity log

Created suggestion 2 months ago
@LeSuisse ignored package rotp 2 months ago
@LeSuisse accepted 2 months ago
@LeSuisse published on GitHub 2 months ago

Insufficient validation of zonemd record

https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerd…

pdns-recursor

<5.2.9
<5.4.1
<5.3.6

NIXPKGS-2026-1240

GitHub issue published 2 months ago

Permalink CVE-2026-33600

4.4 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): High (H)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

updated 2 months ago by @LeSuisse Activity log

Created suggestion 2 months ago
@LeSuisse ignored package rotp 2 months ago
@LeSuisse accepted 2 months ago
@LeSuisse published on GitHub 2 months ago

Null pointer dereference in RPZ transfer

https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerd…

pdns-recursor

<5.2.9
<5.4.1
<5.3.6

NIXPKGS-2026-1239

GitHub issue published 2 months ago

          Permalink
          
            CVE-2026-6861
          
        6.1 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Local (L)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): Required (R)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): None (N)
        
          Integrity (I): Low (L)
        
          Availability (A): High (H)
        
          Modified Attack Vector (MAV): Local (L)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): Required (R)
        
          Modified Confidentiality (MC): None (N)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): Low (L)
        
          Modified Availability (MA): High (H)
        
              updated
            
          2 months ago
          by @ADMIN
        
      Activity log
    
              Created suggestion
            
          2 months ago
          
          @LeSuisse
          
              ignored
            
                25 packages
                qemacs
uemacs
emacs30
chemacs2
emacs-gtk
emacs-nox
emacspeak
emacs-pgtk
emacs30-nox
emacs30-gtk3
emacs30-pgtk
emacs-macport
emacs-anywhere
pinentry-emacs
emacs30-macport
emacs-lsp-booster
parinfer-rust-emacs
emacsclient-commands
emacs-all-the-icons-fonts
haskellPackages.emacs-module
haskellPackages.yi-keymap-emacs
haskellPackages.yi-emacs-colours
vscode-extensions.tuttieee.emacs-mcx
gnomeExtensions.emacs-search-provider
vscode-extensions.jamesyang999.vscode-emacs-minimum

          2 months ago
          
          @LeSuisse
          
              accepted
            
          2 months ago
          
          @LeSuisse
          
              published on GitHub
            
          2 months ago
          
          @ADMIN
          
              restored
            
              package emacs-macport
            
          2 months ago
          
            Emacs: emacs: memory corruption vulnerability when processing svg css
          
      https://access.redhat.com/security/cve/CVE-2026-6861
    
    x_refsource_REDHATvdb-entry
  
      RHBZ#2459992
    
    issue-trackingx_refsource_REDHAT
  
    emacs

          Patch: https://cgit.git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-30&id=8f535370b9efbc91673b20c6987a5cae4f6dc562

NIXPKGS-2026-1238

GitHub issue published 2 months ago

Permalink CVE-2026-33259

5.0 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): High (H)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): High (H)

updated 2 months ago by @LeSuisse Activity log

Created suggestion 2 months ago
@LeSuisse ignored package rotp 2 months ago
@LeSuisse accepted 2 months ago
@LeSuisse published on GitHub 2 months ago

Concurrent modification of RPZ data can lead to denial of servce

https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerd…

pdns-recursor

<5.2.9
<5.4.1
<5.3.6

NIXPKGS-2026-1237

GitHub issue published 2 months ago

Permalink CVE-2026-33598

4.8 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

updated 2 months ago by @LeSuisse Activity log

Created suggestion 2 months ago
@LeSuisse accepted 2 months ago
@LeSuisse published on GitHub 2 months ago

Out-of-bounds read in cache inspection via Lua

https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-…

dnsdist

<2.0.4
<1.9.13

Nixpkgs security tracker

Published issues

Null pointer accces in aggressive NSEC(3) cache

Off-by-one access when processing crafted UDP responses

Crafted zones can cause increased resource usage

Resource exhaustion via DoQ/DoH3 connections

Denial of service via crafted DNSCrypt query

Insufficient validation of zonemd record

Null pointer dereference in RPZ transfer

Emacs: emacs: memory corruption vulnerability when processing svg css

Concurrent modification of RPZ data can lead to denial of servce

Out-of-bounds read in cache inspection via Lua