Nixpkgs security tracker

Login with GitHub

⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Suggestion detail

Untriaged

Permalink CVE-2026-40469

5.1 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): Low (L)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): Low (L)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 1 day, 11 hours ago Activity log

Created suggestion 1 day, 11 hours ago

Heap buffer overflow in gawk

Integer overflow vulnerability has been found in "builtin.c" program file of gawk (do_sub() routine). This issue could be used to overwrite gawk heap metadata and objects causing the program to crash. It affects 32-bit builds of gawk in versions 5.4.0 and below.

References

https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=ae1b2d508f46913269a9… patch
https://cert.pl/en/posts/2026/07/CVE-2026-40467 third-party-advisory

Affected products

gawk

=<5.4.0

Matching in nixpkgs

pkgs.gawk

GNU implementation of the Awk programming language

nixos-unstable 5.4.0
- nixpkgs-unstable 5.4.0
- nixos-unstable-small 5.4.0
nixos-26.05 5.4.0
- nixos-26.05-small 5.4.0
- nixpkgs-26.05-darwin 5.4.0

pkgs.gawkextlib.gd

Dynamically loaded extension libraries for GNU AWK

nixos-unstable 2022-10-20
- nixpkgs-unstable 2022-10-20
- nixos-unstable-small 2022-10-20
nixos-26.05 2022-10-20
- nixos-26.05-small 2022-10-20
- nixpkgs-26.05-darwin 2022-10-20

pkgs.gawkextlib.csv

Dynamically loaded extension libraries for GNU AWK

nixos-unstable 2022-10-20
- nixpkgs-unstable 2022-10-20
- nixos-unstable-small 2022-10-20
nixos-26.05 2022-10-20
- nixos-26.05-small 2022-10-20
- nixpkgs-26.05-darwin 2022-10-20

pkgs.gawkextlib.mbs

Dynamically loaded extension libraries for GNU AWK

nixos-unstable 2022-10-20
- nixpkgs-unstable 2022-10-20
- nixos-unstable-small 2022-10-20
nixos-26.05 2022-10-20
- nixos-26.05-small 2022-10-20
- nixpkgs-26.05-darwin 2022-10-20

pkgs.gawkextlib.xml

Dynamically loaded extension libraries for GNU AWK

nixos-unstable 2022-10-20
- nixpkgs-unstable 2022-10-20
- nixos-unstable-small 2022-10-20
nixos-26.05 2022-10-20
- nixos-26.05-small 2022-10-20
- nixpkgs-26.05-darwin 2022-10-20

pkgs.gawkInteractive

GNU implementation of the Awk programming language

nixos-unstable 5.4.0
- nixpkgs-unstable 5.4.0
- nixos-unstable-small 5.4.0
nixos-26.05 5.4.0
- nixos-26.05-small 5.4.0
- nixpkgs-26.05-darwin 5.4.0

pkgs.gawkextlib.haru

Dynamically loaded extension libraries for GNU AWK

nixos-unstable 2022-10-20
- nixpkgs-unstable 2022-10-20
- nixos-unstable-small 2022-10-20
nixos-26.05 2022-10-20
- nixos-26.05-small 2022-10-20
- nixpkgs-26.05-darwin 2022-10-20

pkgs.gawkextlib.json

Dynamically loaded extension libraries for GNU AWK

nixos-unstable 2022-10-20
- nixpkgs-unstable 2022-10-20
- nixos-unstable-small 2022-10-20
nixos-26.05 2022-10-20
- nixos-26.05-small 2022-10-20
- nixpkgs-26.05-darwin 2022-10-20

pkgs.gawkextlib.lmdb

Dynamically loaded extension libraries for GNU AWK

nixos-unstable 2022-10-20
- nixpkgs-unstable 2022-10-20
- nixos-unstable-small 2022-10-20
nixos-26.05 2022-10-20
- nixos-26.05-small 2022-10-20
- nixpkgs-26.05-darwin 2022-10-20

pkgs.gawkextlib.mpfr

Dynamically loaded extension libraries for GNU AWK

nixos-unstable 2022-10-20
- nixpkgs-unstable 2022-10-20
- nixos-unstable-small 2022-10-20
nixos-26.05 2022-10-20
- nixos-26.05-small 2022-10-20
- nixpkgs-26.05-darwin 2022-10-20

pkgs.gawkextlib.abort

Dynamically loaded extension libraries for GNU AWK

nixos-unstable 2022-10-20
- nixpkgs-unstable 2022-10-20
- nixos-unstable-small 2022-10-20
nixos-26.05 2022-10-20
- nixos-26.05-small 2022-10-20
- nixpkgs-26.05-darwin 2022-10-20

pkgs.gawkextlib.errno

Dynamically loaded extension libraries for GNU AWK

nixos-unstable 2022-10-20
- nixpkgs-unstable 2022-10-20
- nixos-unstable-small 2022-10-20
nixos-26.05 2022-10-20
- nixos-26.05-small 2022-10-20
- nixpkgs-26.05-darwin 2022-10-20

pkgs.gawkextlib.pgsql

Dynamically loaded extension libraries for GNU AWK

nixos-unstable 2022-10-20
- nixpkgs-unstable 2022-10-20
- nixos-unstable-small 2022-10-20
nixos-26.05 2022-10-20
- nixos-26.05-small 2022-10-20
- nixpkgs-26.05-darwin 2022-10-20

pkgs.gawkextlib.redis

Dynamically loaded extension libraries for GNU AWK

nixos-unstable 2022-10-20
- nixpkgs-unstable 2022-10-20
- nixos-unstable-small 2022-10-20
nixos-26.05 2022-10-20
- nixos-26.05-small 2022-10-20
- nixpkgs-26.05-darwin 2022-10-20

pkgs.gawkextlib.timex

Dynamically loaded extension libraries for GNU AWK

nixos-unstable 2022-10-20
- nixpkgs-unstable 2022-10-20
- nixos-unstable-small 2022-10-20
nixos-26.05 2022-10-20
- nixos-26.05-small 2022-10-20
- nixpkgs-26.05-darwin 2022-10-20

pkgs.gawkextlib.aregex

Dynamically loaded extension libraries for GNU AWK

nixos-unstable 2022-10-20
- nixpkgs-unstable 2022-10-20
- nixos-unstable-small 2022-10-20
nixos-26.05 2022-10-20
- nixos-26.05-small 2022-10-20
- nixpkgs-26.05-darwin 2022-10-20

pkgs.gawkextlib.select

Dynamically loaded extension libraries for GNU AWK

nixos-unstable 2022-10-20
- nixpkgs-unstable 2022-10-20
- nixos-unstable-small 2022-10-20
nixos-26.05 2022-10-20
- nixos-26.05-small 2022-10-20
- nixpkgs-26.05-darwin 2022-10-20

pkgs.gawk-with-extensions

None

nixos-unstable -
- nixpkgs-unstable
- nixos-unstable-small
nixos-26.05 -
- nixos-26.05-small
- nixpkgs-26.05-darwin

pkgs.gawkextlib.gawkextlib

Dynamically loaded extension libraries for GNU AWK

nixos-unstable 2022-10-20
- nixpkgs-unstable 2022-10-20
- nixos-unstable-small 2022-10-20
nixos-26.05 2022-10-20
- nixos-26.05-small 2022-10-20
- nixpkgs-26.05-darwin 2022-10-20

pkgs.gawkextlib.nl_langinfo

Dynamically loaded extension libraries for GNU AWK

nixos-unstable 2022-10-20
- nixpkgs-unstable 2022-10-20
- nixos-unstable-small 2022-10-20
nixos-26.05 2022-10-20
- nixos-26.05-small 2022-10-20
- nixpkgs-26.05-darwin 2022-10-20

pkgs.minimal-bootstrap.gawk

GNU implementation of the Awk programming language

nixos-unstable 5.3.2
- nixpkgs-unstable 5.3.2
- nixos-unstable-small 5.3.2
nixos-26.05 5.3.2
- nixos-26.05-small 5.3.2
- nixpkgs-26.05-darwin 5.3.2

pkgs.minimal-bootstrap.gawk-mes

GNU implementation of the Awk programming language

nixos-unstable 3.0.6
- nixpkgs-unstable 3.0.6
- nixos-unstable-small 3.0.6
nixos-26.05 3.0.6
- nixos-26.05-small 3.0.6
- nixpkgs-26.05-darwin 3.0.6

pkgs.minimal-bootstrap.gawk-static

GNU implementation of the Awk programming language

nixos-unstable 5.3.2
- nixpkgs-unstable 5.3.2
- nixos-unstable-small 5.3.2
nixos-26.05 5.3.2
- nixos-26.05-small 5.3.2
- nixpkgs-26.05-darwin 5.3.2

Package maintainers

@dasJ Janne Heß <janne@hess.ooo>
@helsinki-Jo Joachim Ernst <joachim.ernst@helsinki-systems.de>
@tomberek Thomas Bereknyei <tomberek@gmail.com>
@Ericson2314 John Ericson <John.Ericson@Obsidian.Systems>
@emilytrau Emily Trau <emily+nix@downunderctf.com>
@alejandrosame Alejandro Sánchez Medina <alejandrosanchzmedina@gmail.com>
@Gskartwii Aleksi Hannula <ahannula4@gmail.com>
@06kellyjac Jack <hello+nixpkgs@j-k.io>
@pyrox0 Pyrox <pyrox@pyrox.dev>
@Artturin Artturi N <artturin@artturin.com>
@siraben Siraphob Phipathananunth <bensiraphob@gmail.com>