Nixpkgs security tracker

Permalink CVE-2026-40210

4.8 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

updated 3 weeks, 5 days ago by @LeSuisse Activity log

Created suggestion 3 weeks, 6 days ago
@LeSuisse accepted 3 weeks, 5 days ago
@LeSuisse published on GitHub 3 weeks, 5 days ago

Out-of-bounds read in SetMacAddrAction

An out-of-bounds read might happen when SetMacAddrAction is used, potentially resulting in uninitialized memory being sent over the network or a crash.

References

https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-…

Affected products

dnsdist

<1.9.15
<2.0.7

Matching in nixpkgs

pkgs.dnsdist

DNS Loadbalancer

nixos-unstable 2.0.5
- nixpkgs-unstable 2.0.5
- nixos-unstable-small 2.0.5
nixos-26.05 2.0.5
- nixos-26.05-small 2.0.5
- nixpkgs-26.05-darwin 2.0.5

Package maintainers

@jojosch Johannes Schleifenbaum <johannes@js-webcoding.de>

Permalink CVE-2026-40209

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

updated 3 weeks, 5 days ago by @LeSuisse Activity log

Created suggestion 3 weeks, 6 days ago
@LeSuisse accepted 3 weeks, 5 days ago
@LeSuisse published on GitHub 3 weeks, 5 days ago

Denial of service via IXFR queries

An attacker might be able to cause outgoing TCP connections to backend to be stuck until a timeout occurs instead of being released immediately, by sending IXFR queries. This could be used to cause a denial of service if there is a limit to the number of concurrent connections to this backend, or if the process runs out of file descriptors.

References

https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-…

Affected products

dnsdist

<1.9.15
<2.0.7

Matching in nixpkgs

pkgs.dnsdist

DNS Loadbalancer

nixos-unstable 2.0.5
- nixpkgs-unstable 2.0.5
- nixos-unstable-small 2.0.5
nixos-26.05 2.0.5
- nixos-26.05-small 2.0.5
- nixpkgs-26.05-darwin 2.0.5

Package maintainers

@jojosch Johannes Schleifenbaum <johannes@js-webcoding.de>

Permalink CVE-2026-40208

3.7 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

updated 3 weeks, 5 days ago by @LeSuisse Activity log

Created suggestion 3 weeks, 6 days ago
@LeSuisse accepted 3 weeks, 5 days ago
@LeSuisse published on GitHub 3 weeks, 5 days ago

Denial of service via DoH3 queries

An attacker might be able to delay the processing of DoH3 queries by sending DoH3 GET queries with an invalid DATA frame.

References

https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-…

Affected products

dnsdist

<1.9.15
<2.0.7

Matching in nixpkgs

pkgs.dnsdist

DNS Loadbalancer

nixos-unstable 2.0.5
- nixpkgs-unstable 2.0.5
- nixos-unstable-small 2.0.5
nixos-26.05 2.0.5
- nixos-26.05-small 2.0.5
- nixpkgs-26.05-darwin 2.0.5

Package maintainers

@jojosch Johannes Schleifenbaum <johannes@js-webcoding.de>

Permalink CVE-2026-42004

3.7 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

updated 3 weeks, 5 days ago by @LeSuisse Activity log

Created suggestion 3 weeks, 6 days ago
@LeSuisse accepted 3 weeks, 5 days ago
@LeSuisse published on GitHub 3 weeks, 5 days ago

EDNS options smuggling

An attacker can send a crafted EDNS OPT record that will be ignored by DNSdist’s filtering rules, but will be rewritten as a valid OPT record when EDNS Client Subnet is inserted, causing the backend to see the EDNS option(s) that DNSdist did not filter.

References

https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-…

Affected products

dnsdist

<1.9.15
<2.0.7

Matching in nixpkgs

pkgs.dnsdist

DNS Loadbalancer

nixos-unstable 2.0.5
- nixpkgs-unstable 2.0.5
- nixos-unstable-small 2.0.5
nixos-26.05 2.0.5
- nixos-26.05-small 2.0.5
- nixpkgs-26.05-darwin 2.0.5

Package maintainers

@jojosch Johannes Schleifenbaum <johannes@js-webcoding.de>

Permalink CVE-2026-40011

3.7 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

updated 3 weeks, 5 days ago by @LeSuisse Activity log

Created suggestion 3 weeks, 6 days ago
@LeSuisse accepted 3 weeks, 5 days ago
@LeSuisse published on GitHub 3 weeks, 5 days ago

Prometheus denial of service via crafted DNS queries

An attacker sending a large number of crafted DNS queries might be able to trigger a dynamic block being inserted with a value causing invalid output to be produced in the prometheus endpoint. The prometheus endpoint will then be rejected by the scraper until the dynamic block expires.

References

https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-…

Affected products

dnsdist

<1.9.15
<2.0.7

Matching in nixpkgs

pkgs.dnsdist

DNS Loadbalancer

nixos-unstable 2.0.5
- nixpkgs-unstable 2.0.5
- nixos-unstable-small 2.0.5
nixos-26.05 2.0.5
- nixos-26.05-small 2.0.5
- nixpkgs-26.05-darwin 2.0.5

Package maintainers

@jojosch Johannes Schleifenbaum <johannes@js-webcoding.de>

Permalink CVE-2026-40211

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

updated 3 weeks, 5 days ago by @LeSuisse Activity log

Created suggestion 3 weeks, 6 days ago
@LeSuisse accepted 3 weeks, 5 days ago
@LeSuisse published on GitHub 3 weeks, 5 days ago

Denial of service via crafted DoH3 queries

An attacker can send crafted DNS over HTTP/3 queries, triggering an exception that prevents some buffer from being freed right away. The buffer will be freed at the end of the QUIC connection, but on some setups it might be possible to open enough concurrent DoH3 streams to trigger an out-of-memory condition, resulting in a denial of service.

References

https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-…

Affected products

dnsdist

<1.9.15
<2.0.7

Matching in nixpkgs

pkgs.dnsdist

DNS Loadbalancer

nixos-unstable 2.0.5
- nixpkgs-unstable 2.0.5
- nixos-unstable-small 2.0.5
nixos-26.05 2.0.5
- nixos-26.05-small 2.0.5
- nixpkgs-26.05-darwin 2.0.5

Package maintainers

@jojosch Johannes Schleifenbaum <johannes@js-webcoding.de>

Permalink CVE-2026-33260

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

updated 2 months, 4 weeks ago by @LeSuisse Activity log

Created suggestion 3 months ago
@LeSuisse ignored
7 packages
- rotp
- pdnsd
- dnsdist
- pdnsgrep
- pdns-recursor
- home-assistant-component-tests.namecheapdns
- tests.home-assistant-components.namecheapdns
2 months, 4 weeks ago
@LeSuisse accepted 2 months, 4 weeks ago
@LeSuisse restored
2 packages
- dnsdist
- pdns-recursor
2 months, 4 weeks ago
@LeSuisse published on GitHub 2 months, 4 weeks ago

Insufficient input validation of internal webserver

An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.

References

Affected products

pdns

<4.9.14
<5.0.4

dnsdist

<2.0.4
<1.9.13

pdns-recursor

<5.2.9
<5.4.1
<5.3.6

Matching in nixpkgs

pkgs.pdns

Authoritative DNS server

nixos-unstable 5.0.3
- nixpkgs-unstable 5.0.3
- nixos-unstable-small 5.0.3

pkgs.dnsdist

DNS Loadbalancer

nixos-unstable 2.0.3
- nixpkgs-unstable 2.0.3
- nixos-unstable-small 2.0.3

pkgs.pdns-recursor

Recursive DNS server

nixos-unstable 5.4.0
- nixpkgs-unstable 5.4.0
- nixos-unstable-small 5.4.0

Ignored packages (5)

pkgs.rotp

Open-source modernization of the 1993 classic "Master of Orion", written in Java

nixos-unstable 1.04
- nixpkgs-unstable 1.04
- nixos-unstable-small 1.04

pkgs.pdnsd

Permanent DNS caching

nixos-unstable 1.2.9a-par
- nixpkgs-unstable 1.2.9a-par
- nixos-unstable-small 1.2.9a-par

pkgs.pdnsgrep

Search tool for PowerDNS logs

nixos-unstable 1.2.0
- nixpkgs-unstable 1.2.0
- nixos-unstable-small 1.2.0

pkgs.home-assistant-component-tests.namecheapdns

None

pkgs.tests.home-assistant-components.namecheapdns

Open source home automation that puts local control and privacy first

nixos-unstable 2026.4.3
- nixpkgs-unstable 2026.4.2
- nixos-unstable-small 2026.4.3

Package maintainers

@jojosch Johannes Schleifenbaum <johannes@js-webcoding.de>
@Mic92 Jörg Thalheim <joerg@thalheim.io>
@NickCao Nick Cao <nickcao@nichi.co>
@rnhmjoj Michele Guerini Rocco <rnhmjoj@inventati.org>

https://blog.powerdns.com/2026/04/22/powerdns-security-advisory-2026-05-for-powerdns-authoritative-server

Permalink CVE-2026-33257

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

updated 2 months, 4 weeks ago by @LeSuisse Activity log

Created suggestion 3 months ago
@LeSuisse ignored
5 packages
- rotp
- pdnsgrep
- pdnsd
- tests.home-assistant-components.namecheapdns
- home-assistant-component-tests.namecheapdns
2 months, 4 weeks ago
@LeSuisse accepted 2 months, 4 weeks ago
@LeSuisse published on GitHub 2 months, 4 weeks ago

Insufficient input validation of internal webserver

An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.

References

Ignored references (1)

https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-powerd…

Affected products

pdns

<4.9.14
<5.0.4

dnsdist

<2.0.4
<1.9.13

pdns-recursor

<5.2.9
<5.4.1
<5.3.6

Matching in nixpkgs

pkgs.pdns

Authoritative DNS server

nixos-unstable 5.0.3
- nixpkgs-unstable 5.0.3
- nixos-unstable-small 5.0.3

pkgs.dnsdist

DNS Loadbalancer

nixos-unstable 2.0.3
- nixpkgs-unstable 2.0.3
- nixos-unstable-small 2.0.3

pkgs.pdns-recursor

Recursive DNS server

nixos-unstable 5.4.0
- nixpkgs-unstable 5.4.0
- nixos-unstable-small 5.4.0

Ignored packages (5)

pkgs.rotp

Open-source modernization of the 1993 classic "Master of Orion", written in Java

nixos-unstable 1.04
- nixpkgs-unstable 1.04
- nixos-unstable-small 1.04

pkgs.pdnsd

Permanent DNS caching

nixos-unstable 1.2.9a-par
- nixpkgs-unstable 1.2.9a-par
- nixos-unstable-small 1.2.9a-par

pkgs.pdnsgrep

Search tool for PowerDNS logs

nixos-unstable 1.2.0
- nixpkgs-unstable 1.2.0
- nixos-unstable-small 1.2.0

pkgs.home-assistant-component-tests.namecheapdns

None

pkgs.tests.home-assistant-components.namecheapdns

Open source home automation that puts local control and privacy first

nixos-unstable 2026.4.3
- nixpkgs-unstable 2026.4.2
- nixos-unstable-small 2026.4.3

Package maintainers

@jojosch Johannes Schleifenbaum <johannes@js-webcoding.de>
@Mic92 Jörg Thalheim <joerg@thalheim.io>
@NickCao Nick Cao <nickcao@nichi.co>
@rnhmjoj Michele Guerini Rocco <rnhmjoj@inventati.org>

https://blog.powerdns.com/2026/04/22/powerdns-security-advisory-2026-05-for-powerdns-authoritative-server

Permalink CVE-2026-33595

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

updated 2 months, 4 weeks ago by @LeSuisse Activity log

Created suggestion 3 months ago
@LeSuisse accepted 2 months, 4 weeks ago
@LeSuisse published on GitHub 2 months, 4 weeks ago

DoQ/DoH3 excessive memory allocation

A client can trigger excessive memory allocation by generating a lot of errors responses over a single DoQ and DoH3 connection, as some resources were not properly released until the end of the connection.

References

https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-…

Affected products

dnsdist

<2.0.4
<1.9.13

Matching in nixpkgs

pkgs.dnsdist

DNS Loadbalancer

nixos-unstable 2.0.3
- nixpkgs-unstable 2.0.3
- nixos-unstable-small 2.0.3

Package maintainers

@jojosch Johannes Schleifenbaum <johannes@js-webcoding.de>

Permalink CVE-2026-33602

6.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): High (H)

updated 2 months, 4 weeks ago by @LeSuisse Activity log

Created suggestion 3 months ago
@LeSuisse accepted 2 months, 4 weeks ago
@LeSuisse published on GitHub 2 months, 4 weeks ago

Off-by-one access when processing crafted UDP responses

A rogue backend can send a crafted UDP response with a query ID off by one related to the maximum configured value, triggering an out-of-bounds write leading to a denial of service.

References

https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-…

Affected products

dnsdist

<2.0.4
<1.9.13

Matching in nixpkgs

pkgs.dnsdist

DNS Loadbalancer

nixos-unstable 2.0.3
- nixpkgs-unstable 2.0.3
- nixos-unstable-small 2.0.3

Package maintainers

@jojosch Johannes Schleifenbaum <johannes@js-webcoding.de>

Suggestions search

References

Affected products

Matching in nixpkgs

pkgs.dnsdist

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.dnsdist

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.dnsdist

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.dnsdist

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.dnsdist

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.dnsdist

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.pdns

pkgs.dnsdist

pkgs.pdns-recursor

pkgs.rotp

pkgs.pdnsd

pkgs.pdnsgrep

pkgs.home-assistant-component-tests.namecheapdns

pkgs.tests.home-assistant-components.namecheapdns

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.pdns

pkgs.dnsdist

pkgs.pdns-recursor

pkgs.rotp

pkgs.pdnsd

pkgs.pdnsgrep

pkgs.home-assistant-component-tests.namecheapdns

pkgs.tests.home-assistant-components.namecheapdns

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.dnsdist

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.dnsdist

Package maintainers