Nixpkgs security tracker

Login with GitHub

Details of issue NIXPKGS-2026-1280

NIXPKGS-2026-1280

GitHub issue published on

Permalink CVE-2026-42371

5.1 MEDIUM

CVSS version: 3.1
Attack vector (AV): LOCAL
Attack complexity (AC): HIGH
Privileges required (PR): NONE
User interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality impact (C): NONE
Integrity impact (I): NONE
Availability impact (A): HIGH

updated 6 hours ago by @LeSuisse Activity log

Created suggestion 15 hours ago
@LeSuisse ignored maintainer @bosu 6 hours ago maintainer.ignore
@LeSuisse accepted 6 hours ago
@LeSuisse published on GitHub 6 hours ago

uriparser before 1.0.1 has numeric truncation in text range comparison, …

uriparser before 1.0.1 has numeric truncation in text range comparison, if an application accepts URIs with a length in gigabytes.

References

Ignored references (1)

https://uriparser.github.io

Affected products

uriparser

<1.0.1

Matching in nixpkgs

pkgs.uriparser

Strictly RFC 3986 compliant URI parsing library

nixos-unstable 1.0.0
- nixpkgs-unstable 1.0.0
- nixos-unstable-small 1.0.0
nixos-25.11 1.0.0
- nixos-25.11-small 1.0.0
- nixpkgs-25.11-darwin 1.0.0

Package maintainers

Ignored maintainers (1)

@bosu Boris Sukholitko <boriss@gmail.com>