Nixpkgs security tracker
Untriaged
Permalink
CVE-2025-31991
6.8 MEDIUM
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): LOW
- Privileges required (PR): HIGH
- User interaction (UI): NONE
- Scope (S): CHANGED
- Confidentiality impact (C): NONE
- Integrity impact (I): HIGH
- Availability impact (A): NONE
HCL DevOps Velocity is susceptible to brute-force attacks
Rate Limiting for attempting a user login is not being properly enforced, making HCL DevOps Velocity susceptible to brute-force attacks past the unsuccessful login attempt limit. This vulnerability is fixed in 5.1.7.
Affected products
Velocity
- ==<.5.1.7
Matching in nixpkgs
pkgs.velocity
Modern, next-generation Minecraft server proxy
-
nixos-unstable 3.5.0-unstable-2026-04-01
- nixpkgs-unstable 3.5.0-unstable-2026-04-01
- nixos-unstable-small 3.5.0-unstable-2026-04-01
-
nixos-25.11 3.4.0-unstable-2025-11-09
- nixos-25.11-small 3.4.0-unstable-2025-11-09
- nixpkgs-25.11-darwin 3.4.0-unstable-2025-11-09
Package maintainers
-
@Tert0 Tert0 <tert0byte@gmail.com>