Nixpkgs security tracker

Permalink CVE-2026-27878

6.5 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

created 14 hours ago Activity log

Created suggestion 14 hours ago

Tempo TraceQL query with exemplar hint could result in unbounded memory usage

A TraceQL query in Grafana Tempo with a large exemplars hint value can cause the Tempo instance to allocate an excessive amount of memory, resulting in an out-of-memory crash. This could allow an authenticated user to trigger a denial of service against the Tempo service.

References

https://grafana.com/security/security-advisories/cve-2026-27878 vendor-advisory

Affected products

Tempo

<2.10.2

Enterprise Traces (GET)

<2.8.8

Matching in nixpkgs

pkgs.tempo

High volume, minimal dependency trace storage

nixos-unstable 2.10.5
- nixpkgs-unstable 2.10.5
- nixos-unstable-small 3.0.1
nixos-26.05 2.10.5
- nixos-26.05-small 2.10.5
- nixpkgs-26.05-darwin 2.10.5

pkgs.temporal

Microservice orchestration platform which enables developers to build scalable applications without sacrificing productivity or reliability

nixos-unstable 1.30.4
- nixpkgs-unstable 1.30.4
- nixos-unstable-small 1.30.4
nixos-26.05 1.30.4
- nixos-26.05-small 1.30.4
- nixpkgs-26.05-darwin 1.30.4

pkgs.tempora_lgc

Tempora font

nixos-unstable -
- nixpkgs-unstable
- nixos-unstable-small
nixos-26.05 -
- nixos-26.05-small
- nixpkgs-26.05-darwin

pkgs.temporal-cli

Command-line interface for running Temporal Server and interacting with Workflows, Activities, Namespaces, and other parts of Temporal

nixos-unstable 1.7.0
- nixpkgs-unstable 1.7.0
- nixos-unstable-small 1.7.0
nixos-26.05 1.7.0
- nixos-26.05-small 1.7.0
- nixpkgs-26.05-darwin 1.7.0

pkgs.temporal_capi

A Rust implementation of ECMAScript's Temporal API

nixos-unstable 0.2.3
- nixpkgs-unstable 0.2.3
- nixos-unstable-small 0.2.3
nixos-26.05 0.2.3
- nixos-26.05-small 0.2.3
- nixpkgs-26.05-darwin 0.2.3

pkgs.temporal-ui-server

Golang Server for Temporal Web UI

nixos-unstable 2.49.1
- nixpkgs-unstable 2.49.1
- nixos-unstable-small 2.49.1
nixos-26.05 2.49.1
- nixos-26.05-small 2.49.1
- nixpkgs-26.05-darwin 2.49.1

pkgs.gnomeExtensions.tempomate

Effortless time tracking in Jira Tempo timesheets!

nixos-unstable 17
- nixpkgs-unstable 17
- nixos-unstable-small 17
nixos-26.05 17
- nixos-26.05-small 17
- nixpkgs-26.05-darwin 17

pkgs.haskellPackages.temporary

Portable temporary file and directory support

nixos-unstable 1.3
- nixpkgs-unstable 1.3
- nixos-unstable-small 1.3
nixos-26.05 1.3
- nixos-26.05-small 1.3
- nixpkgs-26.05-darwin 1.3

pkgs.python313Packages.tempora

Objects and routines pertaining to date and time

nixos-unstable 5.8.1
- nixpkgs-unstable 5.8.1
- nixos-unstable-small 5.8.1
nixos-26.05 5.8.1
- nixos-26.05-small 5.8.1
- nixpkgs-26.05-darwin 5.8.1

pkgs.python314Packages.tempora

Objects and routines pertaining to date and time

nixos-unstable 5.8.1
- nixpkgs-unstable 5.8.1
- nixos-unstable-small 5.8.1
nixos-26.05 5.8.1
- nixos-26.05-small 5.8.1
- nixpkgs-26.05-darwin 5.8.1

pkgs.haskellPackages.temporary-rc

Portable temporary file and directory support for Windows and Unix, based on code from Cabal

nixos-unstable 1.2.0.3
- nixpkgs-unstable 1.2.0.3
- nixos-unstable-small 1.2.0.3
nixos-26.05 1.2.0.3
- nixos-26.05-small 1.2.0.3
- nixpkgs-26.05-darwin 1.2.0.3

pkgs.python313Packages.temporalio

Temporal Python SDK

nixos-unstable 1.27.2
- nixpkgs-unstable 1.27.2
- nixos-unstable-small 1.27.2
nixos-26.05 1.27.2
- nixos-26.05-small 1.27.2
- nixpkgs-26.05-darwin 1.27.2

pkgs.python314Packages.temporalio

Temporal Python SDK

nixos-unstable 1.27.2
- nixpkgs-unstable 1.27.2
- nixos-unstable-small 1.27.2
nixos-26.05 1.27.2
- nixos-26.05-small 1.27.2
- nixpkgs-26.05-darwin 1.27.2

pkgs.haskellPackages.temporal-media

data types for temporal media

nixos-unstable 0.6.3
- nixpkgs-unstable 0.6.3
- nixos-unstable-small 0.6.3
nixos-26.05 0.6.3
- nixos-26.05-small 0.6.3
- nixpkgs-26.05-darwin 0.6.3

pkgs.haskellPackages.temporary-ospath

Portable temporary file and directory support

nixos-unstable 1.3
- nixpkgs-unstable 1.3
- nixos-unstable-small 1.3
nixos-26.05 1.3
- nixos-26.05-small 1.3
- nixpkgs-26.05-darwin 1.3

pkgs.terraform-providers.temporalcloud

None

nixos-unstable 1.3.0
- nixpkgs-unstable 1.5.0
- nixos-unstable-small 1.5.0
nixos-26.05 1.3.0
- nixos-26.05-small 1.3.0
- nixpkgs-26.05-darwin 1.3.0

pkgs.postgresqlPackages.temporal_tables

Temporal Tables PostgreSQL Extension

nixos-unstable 1.2.2
- nixpkgs-unstable 1.2.2
- nixos-unstable-small 1.2.2
nixos-26.05 1.2.2
- nixos-26.05-small 1.2.2
- nixpkgs-26.05-darwin 1.2.2

pkgs.haskellPackages.temporal-api-protos

None

nixos-unstable 2025.10.1.0
- nixpkgs-unstable 2025.10.1.0
- nixos-unstable-small 2025.10.1.0
nixos-26.05 2025.10.1.0
- nixos-26.05-small 2025.10.1.0
- nixpkgs-26.05-darwin 2025.10.1.0

pkgs.haskellPackages.temporary-resourcet

Portable temporary files and directories with automatic deletion

nixos-unstable 0.1.0.1
- nixpkgs-unstable 0.1.0.1
- nixos-unstable-small 0.1.0.1
nixos-26.05 0.1.0.1
- nixos-26.05-small 0.1.0.1
- nixpkgs-26.05-darwin 0.1.0.1