NIXPKGS-2026-1236

GitHub issue published 2 months ago

Permalink CVE-2026-33594

5.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

Outgoing DoH excessive memory allocation

• https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-…

---

dnsdist

• <2.0.4
• <1.9.13

NIXPKGS-2026-1234

GitHub issue published 2 months ago

Permalink CVE-2026-41314

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse ignored
  10 packages

  • capypdf
  • python312Packages.pypdf2
  • python312Packages.pypdf3
  • python313Packages.pypdf2
  • python313Packages.pypdf3
  • python314Packages.pypdf2
  • python314Packages.pypdf3
  • python312Packages.pypdfium2
  • python313Packages.pypdfium2
  • python314Packages.pypdfium2
  2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

pypdf: Manipulated FlateDecode image dimensions can exhaust RAM

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-x284-j5p8-9c5p x_refsource_CONFIRM
• https://github.com/py-pdf/pypdf/pull/3734 x_refsource_MISC
• https://github.com/py-pdf/pypdf/commit/ac734dab4eef92bcce50d503949b4d9887d89f11 x_refsource_MISC

Ignored references (1)

• https://github.com/py-pdf/pypdf/releases/tag/6.10.2 x_refsource_MISC

---

pypdf

• ==< 6.10.2

NIXPKGS-2026-1235

GitHub issue published 2 months ago

Permalink CVE-2026-41168

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse ignored
  10 packages

  • capypdf
  • python312Packages.pypdf2
  • python312Packages.pypdf3
  • python313Packages.pypdf2
  • python313Packages.pypdf3
  • python314Packages.pypdf2
  • python314Packages.pypdf3
  • python312Packages.pypdfium2
  • python313Packages.pypdfium2
  • python314Packages.pypdfium2
  2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

pypdf has possible long runtimes for wrong size values in cross-reference and object streams

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-jj6c-8h6c-hppx x_refsource_CONFIRM
• https://github.com/py-pdf/pypdf/pull/3733 x_refsource_MISC
• https://github.com/py-pdf/pypdf/commit/62338e9d36419cf193ccec7331784f45df1d70b3 x_refsource_MISC
• https://github.com/py-pdf/pypdf/releases/tag/6.10.1 x_refsource_MISC

---

pypdf

• ==< 6.10.1

NIXPKGS-2026-1233

GitHub issue published 2 months ago

Permalink CVE-2026-33597

3.7 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

PRSD detection denial of service

• https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-…

---

dnsdist

• <2.0.4
• <1.9.13

NIXPKGS-2026-1232

GitHub issue published 2 months ago

Permalink CVE-2026-33262

5.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse ignored package rotp 2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

Insufficient validation of cookie reply

• https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerd…

---

pdns-recursor

• <5.2.9
• <5.4.1
• <5.3.6

NIXPKGS-2026-1231

GitHub issue published 2 months ago

Permalink CVE-2026-32885

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse ignored
  5 packages

  • vdrPlugins.softhddevice
  • python312Packages.sounddevice
  • python313Packages.sounddevice
  • python314Packages.sounddevice
  • haskellPackages.gogol-androiddeviceprovisioning
  2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

DDEV has ZipSlip path traversal in tar and zip archive extraction

• https://github.com/ddev/ddev/security/advisories/GHSA-x2xq-qhjf-5mvg x_refsource_CONFIRMexploit

Ignored references (1)

• https://github.com/ddev/ddev/releases/tag/v1.25.2 x_refsource_MISC

---

ddev

• ==< 1.25.2

NIXPKGS-2026-1230

GitHub issue published 2 months ago

Permalink CVE-2026-33596

3.1 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Adjacent (A)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Adjacent (A)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

TCP backend stream ID overflow

• https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-…

---

dnsdist

• <2.0.4
• <1.9.13

NIXPKGS-2026-1229

GitHub issue published 2 months ago

Permalink CVE-2026-41312

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse ignored
  10 packages

  • capypdf
  • python312Packages.pypdf2
  • python312Packages.pypdf3
  • python313Packages.pypdf2
  • python313Packages.pypdf3
  • python314Packages.pypdf2
  • python314Packages.pypdf3
  • python312Packages.pypdfium2
  • python313Packages.pypdfium2
  • python314Packages.pypdfium2
  2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

pypdf: Manipulated FlateDecode predictor parameters can exhaust RAM

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-7gw9-cf7v-778f x_refsource_CONFIRM
• https://github.com/py-pdf/pypdf/pull/3734 x_refsource_MISC
• https://github.com/py-pdf/pypdf/commit/ac734dab4eef92bcce50d503949b4d9887d89f11 x_refsource_MISC

Ignored references (1)

• https://github.com/py-pdf/pypdf/releases/tag/6.10.2 x_refsource_MISC

---

pypdf

• ==< 6.10.2

NIXPKGS-2026-1228

GitHub issue published 2 months ago

Permalink CVE-2026-33599

3.1 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Adjacent (A)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Adjacent (A)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

Out-of-bounds read in service discovery

• https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-…

---

dnsdist

• <2.0.4
• <1.9.13

NIXPKGS-2026-1227

GitHub issue published 2 months ago

Permalink CVE-2026-33256

5.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 2 months ago by @LeSuisse Activity log

• Created suggestion 2 months ago
• @LeSuisse ignored package rotp 2 months ago
• @LeSuisse accepted 2 months ago
• @LeSuisse published on GitHub 2 months ago

Unbounded memory allocation by internal web server

• https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerd…

---

pdns-recursor

• <5.2.9
• <5.4.1
• <5.3.6