Nixpkgs Security Tracker

Permalink CVE-2026-24825

created 2 weeks, 1 day ago

a memory leak in ydb-platform/ydb with use of yajl_tree_parse function from src/yail module, which will cause out-of-memory in server and cause crash.

Missing Release of Memory after Effective Lifetime vulnerability in ydb-platform ydb (contrib/libs/yajl modules). This vulnerability is associated with program files yail_tree.C. This issue affects ydb: through 24.4.4.2.

Affected products

ydb

=<24.4.4.2

Matching in nixpkgs

pkgs.keydb

Multithreaded Fork of Redis

nixos-25.05 6.3.4
- nixos-25.05-small 6.3.4
- nixpkgs-25.05-darwin 6.3.4

pkgs.sydbox

Seccomp-based application sandbox

nixos-unstable 3.45.0
- nixpkgs-unstable 3.45.0
- nixos-unstable-small 3.45.0
nixos-25.05 3.39.1
- nixos-25.05-small 3.39.1
- nixpkgs-25.05-darwin 3.39.1

pkgs.pgcopydb

Copy a Postgres database to a target Postgres server (pg_dump | pg_restore on steroids

nixos-unstable 0.17
- nixpkgs-unstable 0.17
- nixos-unstable-small 0.17
nixos-25.05 0.15
- nixos-25.05-small 0.15
- nixpkgs-25.05-darwin 0.15

pkgs.dragonflydb

Modern replacement for Redis and Memcached

nixos-unstable 1.34.2
- nixpkgs-unstable 1.34.2
- nixos-unstable-small 1.34.2
nixos-25.05 0.1.0
- nixos-25.05-small 0.1.0
- nixpkgs-25.05-darwin 0.1.0

pkgs.perlPackages.BerkeleyDB

Perl extension for Berkeley DB version 2, 3, 4, 5 or 6

nixos-unstable 0.65
- nixpkgs-unstable 0.65
- nixos-unstable-small 0.65
nixos-25.05 0.65
- nixos-25.05-small 0.65
- nixpkgs-25.05-darwin 0.65

pkgs.python312Packages.pydbus

Pythonic DBus library

nixos-unstable 0.6.0
- nixpkgs-unstable 0.6.0
- nixos-unstable-small 0.6.0
nixos-25.05 0.6.0
- nixos-25.05-small 0.6.0
- nixpkgs-25.05-darwin 0.6.0

pkgs.python312Packages.tinydb

Lightweight document oriented database written in Python

nixos-unstable 4.8.2
- nixpkgs-unstable 4.8.2
- nixos-unstable-small 4.8.2
nixos-25.05 4.8.2
- nixos-25.05-small 4.8.2
- nixpkgs-25.05-darwin 4.8.2

pkgs.python313Packages.pydbus

Pythonic DBus library

nixos-unstable 0.6.0
- nixpkgs-unstable 0.6.0
- nixos-unstable-small 0.6.0
nixos-25.05 0.6.0
- nixos-25.05-small 0.6.0
- nixpkgs-25.05-darwin 0.6.0

pkgs.python313Packages.tinydb

Lightweight document oriented database written in Python

nixos-unstable 4.8.2
- nixpkgs-unstable 4.8.2
- nixos-unstable-small 4.8.2
nixos-25.05 4.8.2
- nixos-25.05-small 4.8.2
- nixpkgs-25.05-darwin 4.8.2

pkgs.google-alloydb-auth-proxy

Utility for connecting securely to your AlloyDB instances

nixos-unstable 1.13.8
- nixpkgs-unstable 1.13.8
- nixos-unstable-small 1.13.8
nixos-25.05 1.13.1
- nixos-25.05-small 1.13.1
- nixpkgs-25.05-darwin 1.13.1

pkgs.haskellPackages.BerkeleyDB

Berkeley DB binding

nixos-unstable 0.8.7
- nixpkgs-unstable 0.8.7
- nixos-unstable-small 0.8.7
nixos-25.05 0.8.7
- nixos-25.05-small 0.8.7
- nixpkgs-25.05-darwin 0.8.7

pkgs.perl538Packages.BerkeleyDB

Perl extension for Berkeley DB version 2, 3, 4, 5 or 6

nixos-unstable 0.65
- nixpkgs-unstable 0.65
- nixos-unstable-small 0.65
nixos-25.05 0.65
- nixos-25.05-small 0.65
- nixpkgs-25.05-darwin 0.65

pkgs.perl540Packages.BerkeleyDB

Perl extension for Berkeley DB version 2, 3, 4, 5 or 6

nixos-unstable 0.65
- nixpkgs-unstable 0.65
- nixos-unstable-small 0.65

pkgs.python312Packages.berkeleydb

Python bindings for Oracle Berkeley DB

nixos-unstable 18.1.14
- nixpkgs-unstable 18.1.14
- nixos-unstable-small 18.1.14
nixos-25.05 18.1.14
- nixos-25.05-small 18.1.14
- nixpkgs-25.05-darwin 18.1.14

pkgs.python313Packages.berkeleydb

Python bindings for Oracle Berkeley DB

nixos-unstable 18.1.14
- nixpkgs-unstable 18.1.14
- nixos-unstable-small 18.1.14
nixos-25.05 18.1.14
- nixos-25.05-small 18.1.14
- nixpkgs-25.05-darwin 18.1.14

pkgs.haskellPackages.amazonka-memorydb

Amazon MemoryDB SDK

nixos-unstable 2.0-unstable-2025-04-16
- nixpkgs-unstable 2.0-unstable-2025-04-16
- nixos-unstable-small 2.0-unstable-2025-04-16
nixos-25.05 2.0
- nixos-25.05-small 2.0
- nixpkgs-25.05-darwin 2.0

pkgs.python312Packages.mypy-boto3-memorydb

Type annotations for boto3 memorydb

nixos-unstable boto3-memorydb-1.41.0
- nixpkgs-unstable boto3-memorydb-1.41.0
- nixos-unstable-small boto3-memorydb-1.41.0
nixos-25.05 boto3-memorydb-1.38.0
- nixos-25.05-small boto3-memorydb-1.38.0
- nixpkgs-25.05-darwin boto3-memorydb-1.38.0

pkgs.python313Packages.mypy-boto3-memorydb

Type annotations for boto3 memorydb

nixos-unstable boto3-memorydb-1.41.0
- nixpkgs-unstable boto3-memorydb-1.41.0
- nixos-unstable-small boto3-memorydb-1.41.0
nixos-25.05 boto3-memorydb-1.38.0
- nixos-25.05-small boto3-memorydb-1.38.0
- nixpkgs-25.05-darwin boto3-memorydb-1.38.0

pkgs.python312Packages.types-aiobotocore-memorydb

Type annotations for aiobotocore memorydb

nixos-unstable 2.25.2
- nixpkgs-unstable 2.25.2
- nixos-unstable-small 2.25.2
nixos-25.05 2.21.1
- nixos-25.05-small 2.21.1
- nixpkgs-25.05-darwin 2.21.1

pkgs.python313Packages.types-aiobotocore-memorydb

Type annotations for aiobotocore memorydb

nixos-unstable 2.25.2
- nixpkgs-unstable 2.25.2
- nixos-unstable-small 2.25.2
nixos-25.05 2.21.1
- nixos-25.05-small 2.21.1
- nixpkgs-25.05-darwin 2.21.1

Package maintainers

@Yureien Soham Sen <contact@sohamsen.me>
@ShawnToubeau Shawn Toubeau <shawntoubeau@gmail.com>
@Conni2461 Simon Hauser <simon-hauser@outlook.com>
@helsinki-Jo Joachim Ernst <joachim.ernst@helsinki-systems.de>
@dasJ Janne Heß <janne@hess.ooo>
@mbalatsko Maksym Balatsko <mbalatsko@gmail.com>
@fabaff Fabian Affolter <mail@fabian-affolter.ch>
@marcus7070 Marcus Boyd <marcus@geosol.com.au>
@illdefined Mikael Voss <mvs@nya.yt>
@getchoo Seth Flynn <getchoo@tuta.io>

Permalink CVE-2026-24124

created 2 weeks, 6 days ago

Dragonfly Manager Job API Allows Unauthenticated Access

Dragonfly is an open source P2P-based file distribution and image acceleration system. In versions 2.4.1-rc.0 and below, the Job API endpoints (/api/v1/jobs) lack JWT authentication middleware and RBAC authorization checks in the routing configuration. This allows any unauthenticated user with access to the Manager API to view, update and delete jobs. The issue is fixed in version 2.4.1-rc.1.

Affected products

dragonfly

==< 2.4.1-rc.1

Matching in nixpkgs

pkgs.dragonflydb

Modern replacement for Redis and Memcached

nixos-unstable 1.34.2
- nixpkgs-unstable 1.34.2
- nixos-unstable-small 1.34.2
nixos-25.05 0.1.0
- nixos-25.05-small 0.1.0
- nixpkgs-25.05-darwin 0.1.0

pkgs.dragonfly-reverb

Hall-style reverb based on freeverb3 algorithms

nixos-unstable 3.2.10
- nixpkgs-unstable 3.2.10
- nixos-unstable-small 3.2.10
nixos-25.05 3.2.10
- nixos-25.05-small 3.2.10
- nixpkgs-25.05-darwin 3.2.10

pkgs.python312Packages.dragonfly

Speech recognition framework allowing powerful Python-based scripting

nixos-unstable 0.35.0
- nixpkgs-unstable 0.35.0
- nixos-unstable-small 0.35.0
nixos-25.05 0.35.0
- nixos-25.05-small 0.35.0
- nixpkgs-25.05-darwin 0.35.0

pkgs.python313Packages.dragonfly

Speech recognition framework allowing powerful Python-based scripting

nixos-unstable 0.35.0
- nixpkgs-unstable 0.35.0
- nixos-unstable-small 0.35.0
nixos-25.05 0.35.0
- nixos-25.05-small 0.35.0
- nixpkgs-25.05-darwin 0.35.0

Package maintainers

@magnetophon Bart Brouns <bart@magnetophon.nl>
@Yureien Soham Sen <contact@sohamsen.me>

Suggestions search

Affected products

Matching in nixpkgs

pkgs.keydb

pkgs.sydbox

pkgs.pgcopydb

pkgs.dragonflydb

pkgs.perlPackages.BerkeleyDB

pkgs.python312Packages.pydbus

pkgs.python312Packages.tinydb

pkgs.python313Packages.pydbus

pkgs.python313Packages.tinydb

pkgs.google-alloydb-auth-proxy

pkgs.haskellPackages.BerkeleyDB

pkgs.perl538Packages.BerkeleyDB

pkgs.perl540Packages.BerkeleyDB

pkgs.python312Packages.berkeleydb

pkgs.python313Packages.berkeleydb

pkgs.haskellPackages.amazonka-memorydb

pkgs.python312Packages.mypy-boto3-memorydb

pkgs.python313Packages.mypy-boto3-memorydb

pkgs.python312Packages.types-aiobotocore-memorydb

pkgs.python313Packages.types-aiobotocore-memorydb

Package maintainers

Affected products

Matching in nixpkgs

pkgs.dragonflydb

pkgs.dragonfly-reverb

pkgs.python312Packages.dragonfly

pkgs.python313Packages.dragonfly

Package maintainers