NIXPKGS-2026-1684

GitHub issue published 3 months, 3 weeks ago

Permalink CVE-2026-41292

6.6 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Exploit Maturity (E): Unreported (U)
Provider Urgency (U): Red (Red)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)

updated 3 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 3 months, 3 weeks ago
@LeSuisse ignored
16 packages
- luaPackages.luaunbound
- lua51Packages.luaunbound
- lua52Packages.luaunbound
- lua53Packages.luaunbound
- lua54Packages.luaunbound
- lua55Packages.luaunbound
- luajitPackages.luaunbound
- prometheus-unbound-exporter
- python312Packages.pyunbound
- python313Packages.pyunbound
- unbound-with-systemd
- haskellPackages.unbound-generics
- haskellPackages.unbound-generics-unify
- haskellPackages.unbound-kind-generics
- haskellPackages.unbounded-delays
- python314Packages.pyunbound
3 months, 3 weeks ago
@LeSuisse restored package unbound-with-systemd 3 months, 3 weeks ago
@LeSuisse ignored maintainer @Scrumplex 3 months, 3 weeks ago maintainer.ignore
@LeSuisse accepted 3 months, 3 weeks ago
@LeSuisse published on GitHub 3 months, 3 weeks ago

Long list of incoming EDNS options degrades performance

https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-41292.txt vendor-advisory

Unbound

<1.25.1

NIXPKGS-2026-1683

GitHub issue published 3 months, 3 weeks ago

Permalink CVE-2026-42923

6.9 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): Low (L)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Provider Urgency (U): Amber (Amber)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): Low (L)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 3 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 3 months, 3 weeks ago
@LeSuisse ignored
15 packages
- luaPackages.luaunbound
- lua51Packages.luaunbound
- lua52Packages.luaunbound
- lua53Packages.luaunbound
- lua54Packages.luaunbound
- lua55Packages.luaunbound
- luajitPackages.luaunbound
- prometheus-unbound-exporter
- python312Packages.pyunbound
- python313Packages.pyunbound
- python314Packages.pyunbound
- haskellPackages.unbound-generics
- haskellPackages.unbounded-delays
- haskellPackages.unbound-kind-generics
- haskellPackages.unbound-generics-unify
3 months, 3 weeks ago
@LeSuisse ignored maintainer @Scrumplex 3 months, 3 weeks ago maintainer.ignore
@LeSuisse accepted 3 months, 3 weeks ago
@LeSuisse published on GitHub 3 months, 3 weeks ago

Degradation of service with unbounded NSEC3 hash calculations

https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42923.txt vendor-advisory

Unbound

<1.25.1

NIXPKGS-2026-1682

GitHub issue published 3 months, 3 weeks ago

Permalink CVE-2026-42534

6.9 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): Low (L)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Provider Urgency (U): Amber (Amber)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): Low (L)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 3 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 3 months, 3 weeks ago
@LeSuisse ignored
16 packages
- luaPackages.luaunbound
- lua51Packages.luaunbound
- lua52Packages.luaunbound
- lua53Packages.luaunbound
- lua54Packages.luaunbound
- lua55Packages.luaunbound
- luajitPackages.luaunbound
- prometheus-unbound-exporter
- python312Packages.pyunbound
- python313Packages.pyunbound
- unbound-with-systemd
- python314Packages.pyunbound
- haskellPackages.unbound-generics
- haskellPackages.unbounded-delays
- haskellPackages.unbound-kind-generics
- haskellPackages.unbound-generics-unify
3 months, 3 weeks ago
@LeSuisse restored package unbound-with-systemd 3 months, 3 weeks ago
@LeSuisse ignored maintainer @Scrumplex 3 months, 3 weeks ago maintainer.ignore
@LeSuisse accepted 3 months, 3 weeks ago
@LeSuisse published on GitHub 3 months, 3 weeks ago

Jostle logic bypass degrades resolution performance

https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42534.txt vendor-advisory

Unbound

<1.25.1

NIXPKGS-2026-1681

GitHub issue published 3 months, 3 weeks ago

Permalink CVE-2026-42960

5.7 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Adjacent (A)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): Present (P)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): High (H)
Subsequent System Impact Availability (SA): High (H)
Exploit Maturity (E): POC (P)
Provider Urgency (U): Amber (Amber)
Modified Attack Vector (MAV): Adjacent (A)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): Present (P)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): High (H)
Modified Subsequent System Impact Availability (MSA): High (H)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)

updated 3 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 3 months, 3 weeks ago
@LeSuisse ignored
15 packages
- luaPackages.luaunbound
- lua51Packages.luaunbound
- lua52Packages.luaunbound
- lua53Packages.luaunbound
- lua54Packages.luaunbound
- lua55Packages.luaunbound
- luajitPackages.luaunbound
- prometheus-unbound-exporter
- python312Packages.pyunbound
- python313Packages.pyunbound
- python314Packages.pyunbound
- haskellPackages.unbound-generics
- haskellPackages.unbounded-delays
- haskellPackages.unbound-kind-generics
- haskellPackages.unbound-generics-unify
3 months, 3 weeks ago
@LeSuisse ignored maintainer @Scrumplex 3 months, 3 weeks ago maintainer.ignore
@LeSuisse accepted 3 months, 3 weeks ago
@LeSuisse published on GitHub 3 months, 3 weeks ago

Possible cache poisoning via promiscuous records for the authority section

https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42960.txt vendor-advisory

Unbound

<1.25.1

NIXPKGS-2026-1680

GitHub issue published 3 months, 3 weeks ago

Permalink CVE-2026-42959

8.7 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Provider Urgency (U): Red (Red)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 3 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 3 months, 3 weeks ago
@LeSuisse ignored
15 packages
- luaPackages.luaunbound
- lua51Packages.luaunbound
- lua52Packages.luaunbound
- lua53Packages.luaunbound
- lua54Packages.luaunbound
- lua55Packages.luaunbound
- luajitPackages.luaunbound
- prometheus-unbound-exporter
- python312Packages.pyunbound
- python313Packages.pyunbound
- python314Packages.pyunbound
- haskellPackages.unbound-generics
- haskellPackages.unbounded-delays
- haskellPackages.unbound-kind-generics
- haskellPackages.unbound-generics-unify
3 months, 3 weeks ago
@LeSuisse ignored maintainer @Scrumplex 3 months, 3 weeks ago maintainer.ignore
@LeSuisse accepted 3 months, 3 weeks ago
@LeSuisse published on GitHub 3 months, 3 weeks ago

Crash during DNSSEC validation of malicious content

https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42959.txt vendor-advisory

Unbound

<1.25.1

NIXPKGS-2026-1679

GitHub issue published 3 months, 3 weeks ago

Permalink CVE-2026-44390

6.9 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): Low (L)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Provider Urgency (U): Amber (Amber)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): Low (L)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 3 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 3 months, 3 weeks ago
@LeSuisse ignored
15 packages
- haskellPackages.unbound-generics-unify
- haskellPackages.unbound-kind-generics
- lua52Packages.luaunbound
- lua53Packages.luaunbound
- lua54Packages.luaunbound
- lua55Packages.luaunbound
- luajitPackages.luaunbound
- prometheus-unbound-exporter
- python312Packages.pyunbound
- python313Packages.pyunbound
- python314Packages.pyunbound
- lua51Packages.luaunbound
- luaPackages.luaunbound
- haskellPackages.unbounded-delays
- haskellPackages.unbound-generics
3 months, 3 weeks ago
@LeSuisse ignored maintainer @Scrumplex 3 months, 3 weeks ago maintainer.ignore
@LeSuisse accepted 3 months, 3 weeks ago
@LeSuisse published on GitHub 3 months, 3 weeks ago

Unbounded name compression in certain cases causes degradation of service

https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-44390.txt vendor-advisory

Unbound

<1.25.1

NIXPKGS-2026-1678

GitHub issue published 3 months, 3 weeks ago

Permalink CVE-2026-42944

8.7 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Provider Urgency (U): Red (Red)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 3 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 3 months, 3 weeks ago
@LeSuisse ignored
15 packages
- luaPackages.luaunbound
- lua51Packages.luaunbound
- lua52Packages.luaunbound
- lua53Packages.luaunbound
- lua54Packages.luaunbound
- lua55Packages.luaunbound
- luajitPackages.luaunbound
- prometheus-unbound-exporter
- python312Packages.pyunbound
- python313Packages.pyunbound
- python314Packages.pyunbound
- haskellPackages.unbound-generics
- haskellPackages.unbounded-delays
- haskellPackages.unbound-kind-generics
- haskellPackages.unbound-generics-unify
3 months, 3 weeks ago
@LeSuisse accepted 3 months, 3 weeks ago
@LeSuisse ignored maintainer @Scrumplex 3 months, 3 weeks ago maintainer.ignore
@LeSuisse published on GitHub 3 months, 3 weeks ago

Heap overflow with multiple NSID, COOKIE, PADDING EDNS options

https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42944.txt vendor-advisory

Unbound

<1.25.1

NIXPKGS-2026-1677

GitHub issue published 3 months, 3 weeks ago

          Permalink
          
            CVE-2026-43619
          
        7.2 HIGH
      
        CVSS version (CVSS): 4.0
      
          Attack Vector (AV): Local (L)
        
          Attack Complexity (AC): High (H)
        
          Attack Requirement (AT): Present (P)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Vulnerable System Impact Confidentiality (VC): High (H)
        
          Vulnerable System Impact Integrity (VI): High (H)
        
          Vulnerable System Impact Availability (VA): None (N)
        
          Subsequent System Impact Confidentiality (SC): None (N)
        
          Subsequent System Impact Integrity (SI): None (N)
        
          Subsequent System Impact Availability (SA): None (N)
        
          Modified Attack Vector (MAV): Local (L)
        
          Modified Attack Complexity (MAC): High (H)
        
          Modified Attack Requirement (MAT): Present (P)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Vulnerable System Impact Confidentiality (MVC): High (H)
        
          Modified Vulnerable System Impact Integrity (MVI): High (H)
        
          Modified Vulnerable System Impact Availability (MVA): None (N)
        
          Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
        
          Modified Subsequent System Impact Integrity (MSI): Negligible (N)
        
          Modified Subsequent System Impact Availability (MSA): Negligible (N)
        
          Safety (S): Not Defined (X)
        
          Automatable (AU): Not Defined (X)
        
          Recovery (R): Not Defined (X)
        
          Value Density (V): Not Defined (X)
        
          Vulnerability Response Effort (RE): Not Defined (X)
        
          Provider Urgency (U): Not Defined (X)
        
          Confidentiality Req. (CR): Not Defined (X)
        
          Integrity Req. (IR): Not Defined (X)
        
          Availability Req. (AR): Not Defined (X)
        
          Exploit Maturity (E): Not Defined (X)
        
              updated
            
          3 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          3 months, 3 weeks ago
          
          @LeSuisse
          
              ignored
            
                19 packages
                grsync
rrsync
rsyncy
btrsync
parsync
librsync
diskrsync
openrsync
vdirsyncer
sqlite-rsync
yaziPlugins.rsync
python313Packages.btrsync
python314Packages.btrsync
python312Packages.sysrsync
python313Packages.sysrsync
python314Packages.sysrsync
python312Packages.vdirsyncer
python313Packages.vdirsyncer
python314Packages.vdirsyncer

          3 months, 3 weeks ago
          
          @LeSuisse
          
              ignored
            
              reference https://w…
            
          3 months, 3 weeks ago
          
          @LeSuisse
          
              accepted
            
          3 months, 3 weeks ago
          
          @LeSuisse
          
              ignored
            
              maintainer @ivan
            
          3 months, 3 weeks ago
          
              maintainer.ignore
            
          @LeSuisse
          
              published on GitHub
            
          3 months, 3 weeks ago
          
            Rsync < 3.4.3 Symlink Race Condition via Path-Based Syscalls
          
      https://github.com/RsyncProject/rsync/security/advisories/GHSA-4h9m-w5ff-j735
    
    vendor-advisory
  
      https://github.com/RsyncProject/rsync/releases/tag/v3.4.3
    
    release-notes
  
          Ignored references (1)
        
      https://www.vulncheck.com/advisories/rsync-symlink-race-condition-via-path-base…
    
    third-party-advisory
  
    rsync

            <3.4.3

NIXPKGS-2026-1676

GitHub issue published 3 months, 3 weeks ago

          Permalink
          
            CVE-2026-43618
          
        6.1 MEDIUM
      
        CVSS version (CVSS): 4.0
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Attack Requirement (AT): Present (P)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Vulnerable System Impact Confidentiality (VC): High (H)
        
          Vulnerable System Impact Integrity (VI): None (N)
        
          Vulnerable System Impact Availability (VA): High (H)
        
          Subsequent System Impact Confidentiality (SC): None (N)
        
          Subsequent System Impact Integrity (SI): None (N)
        
          Subsequent System Impact Availability (SA): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Attack Requirement (MAT): Present (P)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Vulnerable System Impact Confidentiality (MVC): High (H)
        
          Modified Vulnerable System Impact Integrity (MVI): None (N)
        
          Modified Vulnerable System Impact Availability (MVA): High (H)
        
          Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
        
          Modified Subsequent System Impact Integrity (MSI): Negligible (N)
        
          Modified Subsequent System Impact Availability (MSA): Negligible (N)
        
          Safety (S): Not Defined (X)
        
          Automatable (AU): Not Defined (X)
        
          Recovery (R): Not Defined (X)
        
          Value Density (V): Not Defined (X)
        
          Vulnerability Response Effort (RE): Not Defined (X)
        
          Provider Urgency (U): Not Defined (X)
        
          Confidentiality Req. (CR): Not Defined (X)
        
          Integrity Req. (IR): Not Defined (X)
        
          Availability Req. (AR): Not Defined (X)
        
          Exploit Maturity (E): Not Defined (X)
        
              updated
            
          3 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          3 months, 3 weeks ago
          
          @LeSuisse
          
              ignored
            
                19 packages
                grsync
rrsync
rsyncy
btrsync
parsync
librsync
diskrsync
openrsync
vdirsyncer
sqlite-rsync
yaziPlugins.rsync
python313Packages.btrsync
python314Packages.btrsync
python312Packages.sysrsync
python313Packages.sysrsync
python314Packages.sysrsync
python312Packages.vdirsyncer
python313Packages.vdirsyncer
python314Packages.vdirsyncer

          3 months, 3 weeks ago
          
          @LeSuisse
          
              ignored
            
              maintainer @ivan
            
          3 months, 3 weeks ago
          
              maintainer.ignore
            
          @LeSuisse
          
              accepted
            
          3 months, 3 weeks ago
          
          @LeSuisse
          
              ignored
            
              reference https://w…
            
          3 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          3 months, 3 weeks ago
          
            Rsync < 3.4.3 Integer Overflow Information Disclosure
          
      https://github.com/RsyncProject/rsync/security/advisories/GHSA-g37v-g3gj-pmwq
    
    vendor-advisory
  
      https://github.com/RsyncProject/rsync/releases/tag/v3.4.3
    
    release-notes
  
          Ignored references (1)
        
      https://www.vulncheck.com/advisories/rsync-integer-overflow-information-disclos…
    
    third-party-advisory
  
    rsync

            <3.4.3

NIXPKGS-2026-1675

GitHub issue published 3 months, 3 weeks ago

          Permalink
          
            CVE-2026-45232
          
        2.1 LOW
      
        CVSS version (CVSS): 4.0
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): High (H)
        
          Attack Requirement (AT): None (N)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): Active (A)
        
          Vulnerable System Impact Confidentiality (VC): None (N)
        
          Vulnerable System Impact Integrity (VI): None (N)
        
          Vulnerable System Impact Availability (VA): Low (L)
        
          Subsequent System Impact Confidentiality (SC): None (N)
        
          Subsequent System Impact Integrity (SI): None (N)
        
          Subsequent System Impact Availability (SA): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): High (H)
        
          Modified Attack Requirement (MAT): None (N)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): Active (A)
        
          Modified Vulnerable System Impact Confidentiality (MVC): None (N)
        
          Modified Vulnerable System Impact Integrity (MVI): None (N)
        
          Modified Vulnerable System Impact Availability (MVA): Low (L)
        
          Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
        
          Modified Subsequent System Impact Integrity (MSI): Negligible (N)
        
          Modified Subsequent System Impact Availability (MSA): Negligible (N)
        
          Safety (S): Not Defined (X)
        
          Automatable (AU): Not Defined (X)
        
          Recovery (R): Not Defined (X)
        
          Value Density (V): Not Defined (X)
        
          Vulnerability Response Effort (RE): Not Defined (X)
        
          Provider Urgency (U): Not Defined (X)
        
          Confidentiality Req. (CR): Not Defined (X)
        
          Integrity Req. (IR): Not Defined (X)
        
          Availability Req. (AR): Not Defined (X)
        
          Exploit Maturity (E): Not Defined (X)
        
              updated
            
          3 months, 3 weeks ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          3 months, 3 weeks ago
          
          @LeSuisse
          
              ignored
            
                19 packages
                grsync
rrsync
rsyncy
btrsync
parsync
librsync
diskrsync
openrsync
vdirsyncer
sqlite-rsync
yaziPlugins.rsync
python313Packages.btrsync
python314Packages.btrsync
python312Packages.sysrsync
python313Packages.sysrsync
python314Packages.sysrsync
python312Packages.vdirsyncer
python313Packages.vdirsyncer
python314Packages.vdirsyncer

          3 months, 3 weeks ago
          
          @LeSuisse
          
              ignored
            
              maintainer @ivan
            
          3 months, 3 weeks ago
          
              maintainer.ignore
            
          @LeSuisse
          
              accepted
            
          3 months, 3 weeks ago
          
          @LeSuisse
          
              ignored
            
              reference https://w…
            
          3 months, 3 weeks ago
          
          @LeSuisse
          
              published on GitHub
            
          3 months, 3 weeks ago
          
            Rsync < 3.4.3 Off-by-One Stack Write via HTTP Proxy
          
      https://github.com/RsyncProject/rsync/security/advisories/GHSA-8f85-j2cv-59m8
    
    vendor-advisory
  
      https://github.com/RsyncProject/rsync/releases/tag/v3.4.3
    
    release-notes
  
          Ignored references (1)
        
      https://www.vulncheck.com/advisories/rsync-off-by-one-stack-write-via-http-proxy
    
    third-party-advisory
  
    rsync

            <3.4.3

Nixpkgs security tracker

Published issues

Long list of incoming EDNS options degrades performance

Degradation of service with unbounded NSEC3 hash calculations

Jostle logic bypass degrades resolution performance

Possible cache poisoning via promiscuous records for the authority section

Crash during DNSSEC validation of malicious content

Unbounded name compression in certain cases causes degradation of service

Heap overflow with multiple NSID, COOKIE, PADDING EDNS options

Rsync < 3.4.3 Symlink Race Condition via Path-Based Syscalls

Rsync < 3.4.3 Integer Overflow Information Disclosure

Rsync < 3.4.3 Off-by-One Stack Write via HTTP Proxy