Nixpkgs security tracker

Try the new UI
Login with GitHub

Suggestion detail

Untriaged
Permalink CVE-2026-92399
5.5 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): Low (L)
  • Vulnerable System Impact Integrity (VI): Low (L)
  • Vulnerable System Impact Availability (VA): Low (L)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Exploit Maturity (E): POC (P)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
  • Modified Vulnerable System Impact Integrity (MVI): Low (L)
  • Modified Vulnerable System Impact Availability (MVA): Low (L)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
created 5 days, 21 hours ago Activity log
  • Created suggestion 5 days, 21 hours ago
GPAC WebSocket rmt_ws.c rmt_client_handle_ws_frame heap-based overflow

A vulnerability was determined in GPAC 26.07.0. This affects the function rmt_client_handle_ws_frame of the file src/utils/rmt_ws.c of the component WebSocket Handler. Executing a manipulation of the argument payload_size can lead to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.26 is able to mitigate this issue. This patch is called 37bccbb30cf53a0e1a084cea9a1ce422b3ddfe12. Upgrading the affected component is recommended.

Affected products

GPAC
  • ==abi-16.26
  • ==26.07.0

Matching in nixpkgs

pkgs.gpac

Open Source multimedia framework for research and academic purposes

  • nixos-unstable -
  • nixos-26.05 -

pkgs.msgpack-c

MessagePack implementation for C

  • nixos-unstable -
    • nixos-unstable-small 7.0.2
  • nixos-26.05 -
    • nixos-26.05-small 6.1.0

pkgs.msgpack-cxx

MessagePack implementation for C++

  • nixos-unstable -
    • nixos-unstable-small 8.0.0
  • nixos-26.05 -
    • nixos-26.05-small 7.0.0

pkgs.msgpack-tools

Command-line tools for converting between MessagePack and JSON

  • nixos-unstable -
    • nixos-unstable-small 0.6
  • nixos-26.05 -
    • nixos-26.05-small 0.6

pkgs.phpExtensions.msgpack

PHP extension for interfacing with MessagePack

  • nixos-unstable -
    • nixos-unstable-small 3.0.0
  • nixos-26.05 -
    • nixos-26.05-small 3.0.0

Package maintainers