Nixpkgs security tracker

Login with GitHub
⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Suggestion detail

Dismissed
(no matching packages found)
Permalink CVE-2026-4249
8.6 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Changed (C)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
created 1 month, 3 weeks ago Activity log
  • Created & dismissed (no matching packages found) suggestion 1 month, 3 weeks ago
Denial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2 Products Causing Persistent Service Disruption

The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without sufficient validation of their structure and content. This allows an unauthenticated remote attacker to inject malicious JSON data that can lead to a persistent denial of service condition. Successful exploitation of this vulnerability can disrupt the API Gateway, preventing legitimate API traffic from being processed and impacting complete service availability. The denial of service is persistent, requiring manual intervention to restore normal operations.

Affected products

WSO2 API Manager
  • <4.0.0.390
  • <3.2.0.470
  • <4.7.0.2
  • <3.2.0
  • <4.6.0.18
  • <4.1.0.254
  • <3.2.1.89
  • <4.3.0.105
  • <4.4.0.69
  • <4.2.0.194
  • <4.5.0.54
WSO2 Traffic Manager
  • <4.6.0.18
  • <4.5.0.53
  • <4.7.0.2
WSO2 API Control Plane
  • <4.6.0.19
  • <4.5.0.55
  • <4.7.0.2
WSO2 Universal Gateway
  • <4.5.0.54
  • <4.6.0.18
  • <4.7.0.2