Nixpkgs security tracker

Login with GitHub

Suggestion detail

Dismissed
Permalink CVE-2026-66835
8.2 HIGH
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): Present (P)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): High (H)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): Present (P)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): High (H)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 1 week, 1 day ago by @erictapen Activity log
  • Created suggestion 1 week, 1 day ago
  • @erictapen dismissed 1 week, 1 day ago
httpd mod_auth directory protection bypassed by a doubled slash in the request path

Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected directory by prefixing the request path with an extra slash. httpd_request:validate_uri/1 normalises the request URI with uri_string:normalize/1, which performs RFC 3986 dot-segment removal but does not collapse empty path segments, so a doubled slash survives. mod_alias:real_name/3 concatenates the document root with that URI, and mod_auth:secret_path/3 then decides whether the result lies inside a protected directory block by running the configured directory path as an unanchored regular expression against it. The doubled slash breaks the contiguous substring the regex needs, so the request is treated as unprotected and no authentication challenge is issued, while mod_get opens the same path and the operating system collapses the doubled slash and returns the protected file. The same path mismatch also evades the per-path accounting in mod_security. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

Affected products

otp
  • <27.3.4.17
  • <17.0
  • <28.5.0.6
  • <29.0.6
inets
  • <9.6.2.3
  • <9.7.2
  • <5.10
  • <9.3.2.7
erlang/otp
  • *

Matching in nixpkgs

pkgs.cotp

Trustworthy, encrypted, command-line TOTP/HOTP authenticator app with import functionality

pkgs.otpw

One-time password login package

  • nixos-unstable 1.5
    • nixpkgs-unstable 1.5
    • nixos-unstable-small 1.5
  • nixos-26.05 1.5
    • nixos-26.05-small 1.5
    • nixpkgs-26.05-darwin 1.5

pkgs.libcotp

C library that generates TOTP and HOTP

pkgs.otpauth

Google Authenticator migration decoder

pkgs.hotpatch

Hot patching executables on Linux using .so file injection

  • nixos-unstable 0.2
    • nixpkgs-unstable 0.2
    • nixos-unstable-small 0.2
  • nixos-26.05 0.2
    • nixos-26.05-small 0.2
    • nixpkgs-26.05-darwin 0.2

pkgs.totp-cli

Authy/Google Authenticator like TOTP CLI tool written in Go

pkgs.otpclient

Highly secure and easy to use OTP client written in C/GTK that supports both TOTP and HOTP

pkgs.tpm2-totp

Attest the trustworthiness of a device against a human using time-based one-time passwords

pkgs.godotpcktool

Standalone tool for extracting and creating Godot .pck files

  • nixos-unstable 2.2
    • nixpkgs-unstable 2.2
    • nixos-unstable-small 2.3
  • nixos-26.05 2.2
    • nixos-26.05-small 2.2
    • nixpkgs-26.05-darwin 2.2

pkgs.nitrotpm-tools

Collection of utilities for working with NitroTPM attestation

pkgs.gnomeExtensions.totp

Generate One-Time Passwords (aka OTP, both TOTP and HOTP) for websites that use Two-Factor Authentication (2FA) like Google, Facebook, Discord, Amazon, Steam, etc.

  • nixos-unstable 54
    • nixpkgs-unstable 54
    • nixos-unstable-small 54
  • nixos-26.05 54
    • nixos-26.05-small 54
    • nixpkgs-26.05-darwin 54

pkgs.gnomeExtensions.bootpaper

Randomly selects a new wallpaper on startup from local folder

  • nixos-unstable 6
    • nixpkgs-unstable 6
    • nixos-unstable-small 6
  • nixos-26.05 6
    • nixos-26.05-small 6
    • nixpkgs-26.05-darwin 6

Package maintainers

Adressed in https://github.com/NixOS/nixpkgs/pull/558867