Nixpkgs security tracker

Dismissed

(not in Nixpkgs)

Permalink CVE-2026-59803

8.7 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 2 weeks, 3 days ago by @LeSuisse Activity log

Created suggestion 2 weeks, 3 days ago
@LeSuisse dismissed (not in Nixpkgs) 2 weeks, 3 days ago

rpcx - Denial of Service via Gzip Decompression Bomb in Wire Protocol

rpcx through 1.9.3, fixed in commit 047aec1, contains a denial-of-service vulnerability in protocol.Message.Decode (protocol/message.go). When a message has the compression flag set, the payload is gzip-decompressed via util.Unzip with no limit on the decompressed output size. The only built-in size guard, protocol.MaxMessageLength, is checked against the compressed on-the-wire frame length, not the decompressed size, so it provides no protection. Because decoding (and decompression) occurs in readRequest before authentication, a single unauthenticated connection can send a small (under 2 MB) gzip-compressed message that expands to gigabytes of heap allocation, leading to out-of-memory conditions and service unavailability.

References

Researcher Disclosure technical-descriptionexploit
Fix PR issue-tracking
Fix Commit patch
https://www.vulncheck.com/advisories/rpcx-denial-of-service-via-gzip-decompress… third-party-advisory

Affected products

rpcx

==047aec18efa7d037105e2b72c36dd2ae05e1acc6
=<1.9.3

Matching in nixpkgs

pkgs.python313Packages.aiorpcx

Transport, protocol and framing-independent async RPC client and server implementation

nixos-unstable 0.25.0
- nixpkgs-unstable 0.25.0
- nixos-unstable-small 0.25.0
nixos-26.05 0.25.0
- nixos-26.05-small 0.25.0
- nixpkgs-26.05-darwin 0.25.0

pkgs.python314Packages.aiorpcx

Transport, protocol and framing-independent async RPC client and server implementation

nixos-unstable 0.25.0
- nixpkgs-unstable 0.25.0
- nixos-unstable-small 0.25.0
nixos-26.05 0.25.0
- nixos-26.05-small 0.25.0
- nixpkgs-26.05-darwin 0.25.0

Package maintainers

@prusnak Pavol Rusnak <pavol@rusnak.io>

Untriaged

Permalink CVE-2026-33331

8.2 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

created 4 months ago Activity log

Created suggestion 4 months ago

oRPC: Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringify

oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to version 1.13.9, a stored cross-site scripting (XSS) vulnerability exists in the OpenAPI documentation generation of orpc. If an attacker can control any field within the OpenAPI specification (such as info.description), they can break out of the JSON context and execute arbitrary JavaScript when a user views the generated API documentation. This issue has been patched in version 1.13.9.