Nixpkgs security tracker

Published

Permalink CVE-2026-44981

8.2 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): Present (P)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): Present (P)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 2 days ago
@LeSuisse ignored package crowdsec-firewall-bouncer 1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

CrowdSec LAPI: Denial of Service via Unbounded Gzip Decompression

CrowdSec offers crowdsourced protection against malicious IPs. From 1.7.0 until 1.7.8, the LAPI router used gin-contrib/gzip with DefaultDecompressHandle globally in pkg/apiserver/controllers/controller.go, causing /v1/watchers and /v1/watchers/login to decompress unauthenticated gzip-compressed JSON request bodies without enforcing a maximum decompressed size and allowing excessive heap allocation that can make LAPI unreachable. This issue is fixed in version 1.7.8.

References

https://github.com/crowdsecurity/crowdsec/security/advisories/GHSA-273h-gvwr-c3qj x_refsource_CONFIRM
https://github.com/crowdsecurity/crowdsec/commit/54a0dfe6c16b7687b0da6634e0b19ef0f5d9bb30 x_refsource_MISC
https://github.com/crowdsecurity/crowdsec/commit/56d0d6915f7f25941dc5b4f484028646f6601a37 x_refsource_MISC

Affected products

crowdsec

==>= 1.7.0, < 1.7.8

Matching in nixpkgs

pkgs.crowdsec

Free, open-source and collaborative IPS

nixos-unstable 1.7.8
- nixpkgs-unstable 1.7.8
- nixos-unstable-small 1.7.8
nixos-26.05 1.7.7
- nixos-26.05-small 1.7.7
- nixpkgs-26.05-darwin 1.7.7

Ignored packages (1)

pkgs.crowdsec-firewall-bouncer

Crowdsec bouncer written in golang for firewalls

nixos-unstable 0.0.34
- nixpkgs-unstable 0.0.34
- nixos-unstable-small 0.0.34
nixos-26.05 0.0.34
- nixos-26.05-small 0.0.34
- nixpkgs-26.05-darwin 0.0.34

Package maintainers

@06kellyjac Jack <hello+nixpkgs@j-k.io>
@TornaxO7 tornax <tornax@pm.me>

Needs a backport

Published

Permalink CVE-2026-44982

7.2 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

updated 1 week, 1 day ago by @LeSuisse Activity log

Created suggestion 1 week, 2 days ago
@LeSuisse ignored package crowdsec-firewall-bouncer 1 week, 1 day ago
@LeSuisse accepted 1 week, 1 day ago
@LeSuisse published on GitHub 1 week, 1 day ago

CrowdSec AppSec silently drops request body for chunked / HTTP-2 requests

CrowdSec offers crowdsourced protection against malicious IPs. From 1.5.0 until 1.7.8, pkg/appsec/request.go NewParsedRequestFromRequest allocated a request body buffer from max(r.ContentLength, 0), so HTTP/1.1 requests using Transfer-Encoding: chunked and HTTP/2 requests without a content-length header produced an empty body and caused WAF rules targeting REQUEST_BODY, BODY_ARGS, ARGS_POST, JSON, or XML to be skipped. This issue is fixed in version 1.7.8.

References

https://github.com/crowdsecurity/crowdsec/security/advisories/GHSA-rw47-hm26-6wr7 x_refsource_CONFIRM
https://github.com/crowdsecurity/crowdsec/pull/4355 x_refsource_MISC
https://github.com/crowdsecurity/crowdsec/commit/3d5c4d9b127091e9063b9b5eb785372a599a4435 x_refsource_MISC
https://github.com/crowdsecurity/crowdsec/commit/57a793548671e6bbd2cde5562fe87b856ec9c642 x_refsource_MISC
https://github.com/crowdsecurity/crowdsec/releases/tag/v1.7.8 x_refsource_MISC

Affected products

crowdsec

==>= 1.5.0, < 1.7.8

Matching in nixpkgs

pkgs.crowdsec

Free, open-source and collaborative IPS

nixos-unstable 1.7.8
- nixpkgs-unstable 1.7.8
- nixos-unstable-small 1.7.8
nixos-26.05 1.7.7
- nixos-26.05-small 1.7.7
- nixpkgs-26.05-darwin 1.7.7

Ignored packages (1)

pkgs.crowdsec-firewall-bouncer

Crowdsec bouncer written in golang for firewalls

nixos-unstable 0.0.34
- nixpkgs-unstable 0.0.34
- nixos-unstable-small 0.0.34
nixos-26.05 0.0.34
- nixos-26.05-small 0.0.34
- nixpkgs-26.05-darwin 0.0.34

Package maintainers

@06kellyjac Jack <hello+nixpkgs@j-k.io>
@TornaxO7 tornax <tornax@pm.me>

Needs a backport

Suggestions search

References

Affected products

Matching in nixpkgs

pkgs.crowdsec

pkgs.crowdsec-firewall-bouncer

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.crowdsec

pkgs.crowdsec-firewall-bouncer

Package maintainers