Nixpkgs security tracker

Login with GitHub

Suggestion detail

Dismissed
Permalink CVE-2026-26365
4.0 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Changed (C)
  • Confidentiality (C): None (N)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated 5 months ago by @mweinelt Activity log
  • Created suggestion 5 months ago
  • @mweinelt ignored
    23 packages
    • ghost
    • ghostie
    • ghostty
    • ghost-cli
    • ghostfolio
    • ghostunnel
    • ghostscript
    • ghosttohugo
    • ghostty-bin
    • ghostscriptX
    • ghostscript_headless
    • libsForQt5.ghostwriter
    • kdePackages.ghostwriter
    • plasma5Packages.ghostwriter
    • haskellPackages.ghost-buster
    • python312Packages.ghostscript
    • python313Packages.ghostscript
    • python314Packages.ghostscript
    • tests.texlive.dvipng.ghostscript
    • haskellPackages.ghostscript-parallel
    • tree-sitter-grammars.tree-sitter-ghostty
    • python313Packages.tree-sitter-grammars.tree-sitter-ghostty
    • python314Packages.tree-sitter-grammars.tree-sitter-ghostty
    5 months ago
  • @mweinelt dismissed 5 months ago
Akamai Ghost on Akamai CDN edge servers before 2026-02-06 mishandles …

Akamai Ghost on Akamai CDN edge servers before 2026-02-06 mishandles processing of custom hop-by-hop HTTP headers, where an incoming request containing the header "Connection: Transfer-Encoding" could result in a forward request with invalid message framing, depending on the Akamai processing path. This could result in the origin server parsing the request body incorrectly, leading to HTTP request smuggling.

Affected products

Ghost
  • <2026-02-06
Ignored packages (23)

pkgs.ghostie

Github notifications in your terminal

pkgs.ghostty

Fast, native, feature-rich terminal emulator pushing modern features

pkgs.ghostunnel

TLS proxy with mutual authentication support for securing non-TLS backend applications

pkgs.ghostty-bin

Fast, native, feature-rich terminal emulator pushing modern features

Cloud service, not in nixpkgs.