Nixpkgs security tracker

Published

Permalink CVE-2026-2903

3.3 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Exploit Code Maturity (E): Proof-of-Concept (P)
Remediation Level (RL): Official Fix (O)
Report Confidence (RC): Confirmed (C)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

updated 6 months, 4 weeks ago by @LeSuisse Activity log

Created suggestion 6 months, 4 weeks ago
@LeSuisse ignored package vimPlugins.nvim-treesitter-parsers.re2c 6 months, 4 weeks ago
@LeSuisse accepted 6 months, 4 weeks ago
@LeSuisse published on GitHub 6 months, 4 weeks ago

skvadrik re2c ast.cc check_and_merge_special_rules null pointer dereference

A flaw has been found in skvadrik re2c up to 4.4. Impacted is the function check_and_merge_special_rules of the file src/parse/ast.cc. This manipulation causes null pointer dereference. The attack can only be executed locally. The exploit has been published and may be used. Patch name: febeb977936f9519a25d9fbd10ff8256358cdb97. It is suggested to install a patch to address this issue.

References

VDB-347210 | skvadrik re2c ast.cc check_and_merge_special_rules null pointer dereference technical-descriptionvdb-entry
VDB-347210 | CTI Indicators (IOB, IOC, IOA) permissions-requiredsignature
Submit #755030 | skvadrik re2c 04f1424 NULL Pointer Dereference third-party-advisory
https://github.com/skvadrik/re2c/issues/571 issue-tracking
https://github.com/skvadrik/re2c/issues/571#issuecomment-3837675101 issue-tracking
https://github.com/oneafter/0202/blob/main/re/repro exploit
https://github.com/skvadrik/re2c/commit/febeb977936f9519a25d9fbd10ff8256358cdb97 patch
https://github.com/skvadrik/re2c/ product

Affected products

re2c

==4.2
==4.0
==4.1
==4.4
==4.3

Matching in nixpkgs

pkgs.re2c

Tool for writing very fast and very flexible scanners

nixos-unstable 4.4
- nixpkgs-unstable 4.4
- nixos-unstable-small 4.4

Ignored packages (1)

pkgs.vimPlugins.nvim-treesitter-parsers.re2c

None

nixos-unstable 0.0.0+rev=c18a3c2
- nixpkgs-unstable 0.0.0+rev=c18a3c2
- nixos-unstable-small 0.0.0+rev=c18a3c2

Package maintainers

@thoughtpolice Austin Seipp <aseipp@pobox.com>

Upstream issue: https://github.com/skvadrik/re2c/issues/571
Upstream patch: https://github.com/skvadrik/re2c/commit/febeb977936f9519a25d9fbd10ff8256358cdb97