Nixpkgs security tracker

Login with GitHub
⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Suggestion detail

Untriaged
Permalink CVE-2026-31984
8.7 HIGH
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): High (H)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): High (H)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
created 6 days, 2 hours ago Activity log
  • Created suggestion 6 days, 2 hours ago
DoS through oversized audit log entries in Guardian/CMC before 26.2.0

A denial-of-service vulnerability caused by unbounded resource allocation was discovered in the audit logging functionality, due to a missing size limit on input recorded into audit entries. An unauthenticated attacker can submit requests containing excessively large input that is recorded into audit entries, possibly exhausting the available disk space and rendering the system inoperable.

Affected products

CMC
  • <26.2.0
Guardian
  • <26.2.0

Matching in nixpkgs

pkgs.cmc

Manages SSH ControlMaster sessions

pkgs.cmctl

Command line utility to interact with a cert-manager instalation on Kubernetes

pkgs.scmccid

PCSC drivers for linux, for the SCM SCR3310 v2.0 card and others

pkgs.adguardian

Terminal-based, real-time traffic monitoring and statistics for your AdGuard Home instance

pkgs.pcmciaUtils

None

  • nixos-unstable 018
    • nixpkgs-unstable 018
    • nixos-unstable-small 018
  • nixos-26.05 018
    • nixos-26.05-small 018
    • nixpkgs-26.05-darwin 018

pkgs.pcmciautils

None

  • nixos-unstable 018
    • nixpkgs-unstable 018
    • nixos-unstable-small 018
  • nixos-26.05 018
    • nixos-26.05-small 018
    • nixpkgs-26.05-darwin 018

Package maintainers