Nixpkgs security tracker

Login with GitHub

Suggestion detail

Dismissed
Permalink CVE-2026-74835
8.7 HIGH
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): High (H)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): High (H)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 1 week, 1 day ago by @erictapen Activity log
  • Created suggestion 1 week, 1 day ago
  • @erictapen ignored
    5 packages
    • cotp
    • linuxKernel.packages.linux_5_15.can-isotp
    • linuxKernel.packages.linux_5_10.can-isotp
    • python314Packages.django-otp-webauthn
    • python313Packages.django-otp-webauthn
    1 week, 1 day ago
  • @erictapen dismissed 1 week, 1 day ago
inets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body Reception

The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

Affected products

otp
  • <27.3.4.17
  • <17.0
  • <28.5.0.6
  • <29.0.6
inets
  • <9.6.2.3
  • <9.7.2
  • <5.10
  • <9.3.2.7
erlang/otp
  • *

Matching in nixpkgs

pkgs.otpw

One-time password login package

  • nixos-unstable 1.5
    • nixpkgs-unstable 1.5
    • nixos-unstable-small 1.5
  • nixos-26.05 1.5
    • nixos-26.05-small 1.5
    • nixpkgs-26.05-darwin 1.5

pkgs.libcotp

C library that generates TOTP and HOTP

pkgs.otpauth

Google Authenticator migration decoder

pkgs.hotpatch

Hot patching executables on Linux using .so file injection

  • nixos-unstable 0.2
    • nixpkgs-unstable 0.2
    • nixos-unstable-small 0.2
  • nixos-26.05 0.2
    • nixos-26.05-small 0.2
    • nixpkgs-26.05-darwin 0.2

pkgs.totp-cli

Authy/Google Authenticator like TOTP CLI tool written in Go

pkgs.otpclient

Highly secure and easy to use OTP client written in C/GTK that supports both TOTP and HOTP

pkgs.tpm2-totp

Attest the trustworthiness of a device against a human using time-based one-time passwords

pkgs.godotpcktool

Standalone tool for extracting and creating Godot .pck files

  • nixos-unstable 2.2
    • nixpkgs-unstable 2.2
    • nixos-unstable-small 2.3
  • nixos-26.05 2.2
    • nixos-26.05-small 2.2
    • nixpkgs-26.05-darwin 2.2

pkgs.nitrotpm-tools

Collection of utilities for working with NitroTPM attestation

pkgs.gnomeExtensions.totp

Generate One-Time Passwords (aka OTP, both TOTP and HOTP) for websites that use Two-Factor Authentication (2FA) like Google, Facebook, Discord, Amazon, Steam, etc.

  • nixos-unstable 54
    • nixpkgs-unstable 54
    • nixos-unstable-small 54
  • nixos-26.05 54
    • nixos-26.05-small 54
    • nixpkgs-26.05-darwin 54

pkgs.gnomeExtensions.bootpaper

Randomly selects a new wallpaper on startup from local folder

  • nixos-unstable 6
    • nixpkgs-unstable 6
    • nixos-unstable-small 6
  • nixos-26.05 6
    • nixos-26.05-small 6
    • nixpkgs-26.05-darwin 6
Ignored packages (5)

pkgs.cotp

Trustworthy, encrypted, command-line TOTP/HOTP authenticator app with import functionality

Package maintainers

Adressed in https://github.com/NixOS/nixpkgs/pull/558867