Nixpkgs security tracker

Permalink CVE-2026-21729

7.5 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

created 6 days, 2 hours ago Activity log

Created suggestion 6 days, 2 hours ago

Loki detected_fields query limits results in unbounded memory allocation

Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy.

References

https://grafana.com/security/security-advisories/cve-2026-21729 vendor-advisory

Affected products

Loki

<v3.7.0

Matching in nixpkgs

pkgs.loki

C++ library of designs, containing flexible implementations of common design patterns and idioms

nixos-unstable 0.1.7
- nixpkgs-unstable 0.1.7
- nixos-unstable-small 0.1.7
nixos-26.05 0.1.7
- nixos-26.05-small 0.1.7
- nixpkgs-26.05-darwin 0.1.7

pkgs.loki-tool

Tool for custom firmware on AT&T/Verizon Samsung and LG devices

nixos-unstable 0-unstable-2016-06-27
- nixpkgs-unstable 0-unstable-2016-06-27
- nixos-unstable-small 0-unstable-2016-06-27
nixos-26.05 0-unstable-2016-06-27
- nixos-26.05-small 0-unstable-2016-06-27
- nixpkgs-26.05-darwin 0-unstable-2016-06-27

pkgs.grafana-loki

Like Prometheus, but for logs

nixos-unstable 3.7.2
- nixpkgs-unstable 3.7.3
- nixos-unstable-small 3.7.3
nixos-26.05 3.7.3
- nixos-26.05-small 3.7.3
- nixpkgs-26.05-darwin 3.7.3

pkgs.python313Packages.python-logging-loki

Python logging handler for Loki

nixos-unstable 0.3.1
- nixpkgs-unstable 0.3.1
- nixos-unstable-small 0.3.1
nixos-26.05 0.3.1
- nixos-26.05-small 0.3.1
- nixpkgs-26.05-darwin 0.3.1

pkgs.python314Packages.python-logging-loki

Python logging handler for Loki

nixos-unstable 0.3.1
- nixpkgs-unstable 0.3.1
- nixos-unstable-small 0.3.1
nixos-26.05 0.3.1
- nixos-26.05-small 0.3.1
- nixpkgs-26.05-darwin 0.3.1

pkgs.grafanaPlugins.grafana-lokiexplore-app

Browse Loki logs without the need for writing complex queries

nixos-unstable 2.1.3
- nixpkgs-unstable 2.1.5
- nixos-unstable-small 2.1.5
nixos-26.05 2.0.4
- nixos-26.05-small 2.0.4
- nixpkgs-26.05-darwin 2.0.4

pkgs.python313Packages.pysigma-backend-loki

Library to support the loki backend for pySigma

nixos-unstable 0.13.0
- nixpkgs-unstable 0.13.0
- nixos-unstable-small 0.13.0
nixos-26.05 0.13.0
- nixos-26.05-small 0.13.0
- nixpkgs-26.05-darwin 0.13.0

pkgs.python314Packages.pysigma-backend-loki

Library to support the loki backend for pySigma

nixos-unstable 0.13.0
- nixpkgs-unstable 0.13.0
- nixos-unstable-small 0.13.0
nixos-26.05 0.13.0
- nixos-26.05-small 0.13.0
- nixpkgs-26.05-darwin 0.13.0

Package maintainers

@mmahut Marek Mahut <marek.mahut@gmail.com>
@ryan4yin Ryan Yin <xiaoyin_c@qq.com>
@globin Robin Gloster <mail@glob.in>
@emilylange Emily Lange <nix@emilylange.de>
@loispostula Loïs Postula <lois@postu.la>
@peterhoeg Peter Hoeg <peter@hoeg.com>
@hadilq Hadi Lashkari Ghouchani <hadilq.dev@gmail.com>
@numinit Morgan Jones <me+nixpkgs@numin.it>
@RossComputerGuy Tristan Ross <tristan.ross@midstall.com>
@adrian-gierakowski Adrian Gierakowski <adrian.gierakowski@gmail.com>
@johnrtitor Masum Reza <masumrezarock100@gmail.com>
@ungeskriptet David Wronek <nix@david-w.eu>
@fabaff Fabian Affolter <mail@fabian-affolter.ch>
@Moraxyc Moraxyc Xu <i@qaq.li>

Permalink CVE-2026-21726

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 3 months, 1 week ago by @LeSuisse Activity log

Created suggestion 3 months, 1 week ago
@LeSuisse ignored
2 packages
- loki-tool
- loki
3 months, 1 week ago

Loki Path Traversal - CVE-2021-36156 Bypass

The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/rules/{namespace} Thanks to Prasanth Sundararajan for reporting this vulnerability.