Nixpkgs security tracker

Untriaged

Permalink CVE-2026-1301

created 2 months, 1 week ago Activity log

Created suggestion 2 months, 1 week ago

Out-of-bounds Write in o6 Automation GmbH Open62541

In builds with PubSub and JSON enabled, a crafted JSON message can cause the decoder to write beyond a heap-allocated array before authentication, reliably crashing the process and corrupting memory.

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-036-03 government-resource

Affected products

Open62541

<1.5-rc2

Matching in nixpkgs

pkgs.open62541

Open source implementation of OPC UA

nixos-unstable 1.4.12
- nixpkgs-unstable 1.4.14
- nixos-unstable-small 1.4.14
nixos-25.11 1.4.14
- nixpkgs-25.11-darwin 1.4.14

pkgs.open62541pp

C++ wrapper of the open62541 OPC UA library

nixos-unstable 0.19.0
- nixpkgs-unstable 0.20.0
- nixos-unstable-small 0.20.0
nixos-25.11 0.20.0
- nixpkgs-25.11-darwin 0.20.0

Package maintainers