Ecosystem
Hackage
36 known vulnerabilities.
Most affected packages
36 results · Feed
-
Unscored —
HTTP Request Smuggling in warp
# HTTP Request Smuggling in warp warp's HTTP/1.x request parser accepted request framing that RFC 9112 requires recipients to refuse, so a request could frame one way for a front-end proxy reading it and another way for warp behind it. Whoever reads such a re…
-
Unscored —
Out-of-bounds read in Eq and Ord on numbers with extreme exponents
# Out-of-bounds read in Eq and Ord on numbers with extreme exponents `scientific-0.3.9.0` reimplemented `Eq` and `Ord` without normalising their arguments. The new implementation short-circuits on `integerLog10' c + e` computed in `Int`, which overflows when …
-
Unscored —
Superlinear encoding of numbers with large coefficients
# Superlinear encoding of numbers with large coefficients Encoding (pretty-printing) a `Scientific` number whose coefficient has many digits took time quadratic in the number of digits: the decimal digits were extracted by repeatedly dividing the whole coeffi…
-
Unscored —
Improper parsing of fractional NumericDate from JWT exp claims
# Improper parsing of fractional `NumericDate` from JWT `exp` claims Since its [initial commit][], package jwt uses [`Data.Scientific.coefficient`][scientific] to extract the fractional mantissa in a way that improperly *discards the exponent*. This can lead …
-
Critical 9.1
CVE-2026-9648
The crypton-x509-validation Haskell library fails to enforce X.509 NameConstraints, allowing TLS clients to accept certificates whose Subject Alternative Names fall outside the issuing CA’s permitted subtrees. This oversight enables an attacker who compromise…
-
Unscored —
Denial of Service and Memory Exhaustion in aeson
# Denial of Service and Memory Exhaustion in aeson A Denial of Service (DoS) and memory exhaustion vulnerability was identified in the `aeson` package. The vulnerability allows an attacker to exhaust server memory and crash the host process by supplying malic…
-
Critical 9.9
Hackage package metadata stored XSS vulnerability
In hackage-server, user-controlled metadata from .cabal files are rendered into HTML href attributes without proper sanitization, enabling stored Cross-Site Scripting (XSS) attacks.
-
Critical 9.6
Hackage CSRF vulnerability
hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. Scripts on foreign sites could trigger requests to hackage server, possibly abusing latent credentials to upload packages or perform other administrative actions. Some un…
-
Critical 9.9
Hackage package and doc upload stored XSS vulnerability
A critical XSS vulnerability affected hackage-server and hackage.haskell.org. HTML and JavaScript files provided in source packages or via the documentation upload facility were served as-is on the main hackage.haskell.org domain. As a consequence, when a use…
-
Unscored —
Cabal deletes project source files during configure
# Cabal deletes project source files during configure The `checkDuplicateHeaders` function in `Distribution.Simple.Configure` removes header files from the source directory when a header with the same name exists in both the build directory and the source dir…
-
Unscored —
Private key leak via inherited file descriptor
# Private key leak via inherited file descriptor The X.509 key reading function `readKeyFile` opened a file descriptor to the private key without setting the *close-on-exec* flag. If a child process is `exec`ed at the same time, it would inherit that file des…
-
Unscored —
cabal-install dependency confusion
# `cabal-install` dependency confusion For **cabal-install < 3.4.0.0** and where multiple repositories are configured, the resolver picks the highest available version across all repositories. Where a package is only defined in a private repository, this beha…
-
Unscored —
Broken Path Sanitization in spacecookie Library
# Broken Path Sanitization in spacecookie Library The spacecookie library exposes the functions `sanitizePath` and `sanitizeIfNotUrl` intended to remove `..` components from paths which can be used to prevent path traversal attacks. Due to erroneous compariso…
-
Unscored —
Double Public Key Signing Function Oracle Attack on Ed25519
# Double Public Key Signing Function Oracle Attack on Ed25519 The standard specification of Ed25519 message signing involves providing the algorithm with a message and private key. The function will use the private key to compute the public key and sign the m…
-
Unscored —
fromIntegral: conversion error
# `fromIntegral`: conversion error `fromIntegral` may result in coercion errors when used with optimization flags `-O1` or `-O2` in the following situation: - Converting negative `Int` to `Natural` does not throw an arithmetic underflow error - Converting lar…
-
Unscored —
Reflected XSS vulnerability in keter
# Reflected XSS vulnerability in keter Keter is an app-server/reverse-proxy often used with webapps build on Yesod web-framework. In the logic handling VHost dispatch, Keter was echoing back `Host` header value, unescaped, as part of an HTML error page. This …
-
Unscored —
cabal-install uses expired key policies
# cabal-install uses expired key policies A problem was recently discovered in `cabal-install`'s implementation of the Hackage Security protocol that would allow an attacker who was in possession of a revoked private key and who could perform a man-in-the-mid…
-
Unscored —
git-annex checksum exposure to encrypted special remotes
# *git-annex* checksum exposure to encrypted special remotes A bug exposed the checksum of annexed files to encrypted special remotes, which are not supposed to have access to the checksum of the un-encrypted file. This only occurred when resuming uploads to …
-
Unscored —
readFloat: memory exhaustion with large exponent
# `readFloat`: memory exhaustion with large exponent `Numeric.readFloat` takes time and memory linear in the size of the number _denoted_ by the input string. In particular, processing a number expressed in scientific notation with a very large exponent could…
-
Unscored —
x509-validation does not enforce pathLenConstraint
# x509-validation does not enforce pathLenConstraint *x509-validation* prior to version 1.4.8 did not enforce the pathLenConstraint value. Constrained CAs could accidentally (or deliberately) issue CAs below the maximum depth and *x509-validation* would accep…
-
High 7.5
S3 and Glacier remotes creds embedded in the git repo were not encrypted
git-annex had a bug in the S3 and Glacier remotes where if embedcreds=yes was set, and the remote used encryption=pubkey or encryption=hybrid, the embedded AWS credentials were stored in the git repository in (effectively) plaintext, not encrypted as they wer…
-
High 8.7
XZ has a heap-use-after-free bug in threaded .xz decoder
XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after fre…
-
Low 3.0
biscuit-rust vulnerable to public key confusion in third party block
biscuit-rust is the Rust implementation of Biscuit, an authentication and authorization token for microservices architectures. Third-party blocks can be generated without transferring the whole token to the third-party authority. Instead, a ThirdPartyBlock re…
-
Critical 9.8
Command injection vulnerability in programing languages on Microsoft Windows operating system.
A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.
-
Medium 6.0
Arbitrary file write is possible in Pandoc when using PDF output or --extract-media with untrusted input
Pandoc is a Haskell library for converting from one markup format to another, and a command-line tool that uses this library. Starting in version 1.13 and prior to version 3.1.4, Pandoc is susceptible to an arbitrary file write vulnerability, which can be tri…
-
Unscored —
Stored XSS in hledger-web
An issue was discovered in hledger before 1.23. A Stored Cross-Site Scripting (XSS) vulnerability exists in toBloodhoundJson that allows an attacker to execute JavaScript by encoding user-controlled values in a payload with base64 and parsing them with the at…
-
Medium 5.3
Quadratic complexity may lead to a denial of service in cmark-gfm
cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity …
-
Medium 4.3
xml-conduit DOCTYPE Entity Expansion Parse.hs infinite loop
A vulnerability was found in xml-conduit. It has been classified as problematic. Affected is an unknown function of the file xml-conduit/src/Text/XML/Stream/Parse.hs of the component DOCTYPE Entity Expansion Handler. The manipulation leads to infinite loop. I…
-
Unscored —
Hash flooding vulnerability in aeson
The aeson library is not safe to use to consume untrusted JSON input. A remote user could abuse this flaw to produce a hash collision in the underlying unordered-containers library by sending specially crafted JSON data, resulting in a denial of service.
-
Critical 9.8
Signature forgery in Biscuit
Biscuit is an authentication and authorization token for microservices architectures. The Biscuit specification version 1 contains a vulnerable algorithm that allows malicious actors to forge valid Γ-signatures. Such an attack would allow an attacker to creat…
-
Unscored —
tls-extra: certificate validation does not check Basic Constraints
haskell-tls-extra before 0.6.1 has Basic Constraints attribute vulnerability may lead to Man in the Middle attacks on TLS connections
-
Critical 9.8
out-of-bounds write when there are many bzip2 selectors
BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.
-
Medium 5.9
git-annex private data exfiltration to compromised remote
git-annex is vulnerable to a private data exposure and exfiltration attack. It could expose the content of files located outside the git-annex repository, or content from a private web server on localhost or the LAN.
-
Medium 5.9
git-annex GPG decryption attack via compromised remote
git-annex is vulnerable to an Information Exposure when decrypting files. A malicious server for a special remote could trick git-annex into decrypting a file that was encrypted to the user's gpg key. This attack could be used to expose encrypted data that wa…
-
Unscored —
git-annex command injection via malicious SSH hostname
git-annex before 6.20170818 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, as demonstrated by an ssh://-eProxyCommand= URL, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-100011…
-
Unscored —CVE-2013-1436 Public exploit
code injection in xmonad-contrib
The XMonad.Hooks.DynamicLog module in xmonad-contrib before 0.11.2 allows remote attackers to execute arbitrary commands via a web page title, which activates the commands when the user clicks on the xmobar window title, as demonstrated using an action tag.