Read the docs
TI-2026-32066 Aliases CVE-2026-44028GHSA-jggj-j5fq-x969

Uncontrolled recursion in NixOS Nix

Priority LOW 34CWE-674Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Denial of service
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-674.

Summary

An issue was discovered in Nix before 2.34.7 and Lix before 2.95.2. Unbounded recursion in the NAR (Nix Archive) parser could lead to a stack-to-heap overflow when the parser is run on a coroutine stack. The stack is allocated without a guard page, which means that a stack overflow could overwrite memory on the heap and could allow arbitrary code execution as the Nix daemon (run as root in multi-user installations) if ASLR hardening is bypassed. This can be exploited by all users able to connect to the daemon (e.g., in Nix, this is configurable via the allowed-users setting, defaulting to all users). The fixed versions are 2.34.7, 2.33.6, 2.32.8, 2.31.5, 2.30.5, 2.29.4, and 2.28.7 for Nix (introduced in 2.24.4); and 2.95.2, 2.94.2, and 2.93.4 for Lix (introduced in 2.93.0).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0018 7th percentileScored 2026-11-07
Fix Fixed Nix (NixOS): 2.28.7, 2.29.4, 2.30.5 +4Lix (Lix Project): 2.93.4, 2.94.2, 2.95.2Red Hat: 4 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NixOSNix2.24.4 to before 2.28.7; 2.29.0 to before 2.29.4; 2.30.0 to before 2.30.5; 2.31.0 to before 2.31.5; 2.32.0 to before 2.32.8; 2.33.0 to before 2.33.6; 2.34.0 to before 2.34.72.28.7, 2.29.4, 2.30.5, 2.31.5, 2.32.8, 2.33.6, 2.34.7Patch availableCNA
Lix ProjectLix2.93.0 to before 2.93.4; 2.94.0 to before 2.94.2; 2.95.0 to before 2.95.22.93.4, 2.94.2, 2.95.2Patch availableCNA
  • Nix VendorNixOS Affected 2.24.4 to before 2.28.7; 2.29.0 to before 2.29.4; 2.30.0 to before 2.30.5; 2.31.0 to before 2.31.5; 2.32.0 to before 2.32.8; 2.33.0 to before 2.33.6; 2.34.0 to before 2.34.7 Fixed in 2.28.7, 2.29.4, 2.30.5, 2.31.5, 2.32.8, 2.33.6, 2.34.7 Patch available CNA
  • Lix VendorLix Project Affected 2.93.0 to before 2.93.4; 2.94.0 to before 2.94.2; 2.95.0 to before 2.95.2 Fixed in 2.93.4, 2.94.2, 2.95.2 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*——NixOS
  • cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:* Versions — — ·NixOS

Remediation

  • Fix · CNA Nix (NixOS) Fixed in 2.28.7, 2.29.4, 2.30.5, 2.31.5, 2.32.8, 2.33.6, 2.34.7
  • Fix · CNA Lix (Lix Project) Fixed in 2.93.4, 2.94.2, 2.95.2

Red Hat 4 advisories

  • RHSA-2026:10999 Released 2026-04-27 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images python3-ruff-0.15.11-1.hum1@noarch@public-hummingbird-aarch64-rpms, python3-ruff-0.15.11-1.hum1@noarch@public-hummingbird-x86_64-rpms, ruff-0.15.11-1.hum1@aarch64 +2
  • RHSA-2026:10208 Released 2026-04-23 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images chunkah-0.4.0-1.hum1@aarch64, chunkah-0.4.0-1.hum1@src, chunkah-0.4.0-1.hum1@x86_64
  • RHSA-2026:9438 Released 2026-04-21 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images rust-1.95.0-2.hum1@aarch64, rust-1.95.0-2.hum1@src, rust-1.95.0-2.hum1@x86_64 +28
Show 1 more Red Hat advisories
  • RHSA-2026:7046 Released 2026-04-08 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images bootc-1.14.0-0.1.1.hum1@aarch64, bootc-1.14.0-0.1.1.hum1@src, bootc-1.14.0-0.1.1.hum1@x86_64 +2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    NixOS Nix 2.28.7, 2.29.4 and 5 more versions

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-32067 An issue was discovered in Nix before 2.34.7.Priority LOW 31
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Hardened ImagesFixed RHSA-2026:10208, RHSA-2026:10999, RHSA-2026:7046, RHSA-2026:9438

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44028
  2. 2026-10-03 Alias added: GHSA-jggj-j5fq-x969

References

Other 5

  • TI-2026-23989 crypto: algif_aead - Revert to operating out-of-place KEVCVSS 3.1HIGH 7.8
  • TI-2024-11208 Rsync: heap buffer overflow in rsync due to improper checksum length handling CVSS 3.1CRITICAL 9.8
  • TI-2026-19201 Tandoor Recipes module allows SQLite database to be externally accessible with the default settings CVSS 4.0HIGH 8.7
  • TI-2024-11209 Rsync: info leak via uninitialized stack contents CVSS 3.1HIGH 7.5
  • TI-2024-11212 Rsync: --safe-links option bypass leads to path traversal CVSS 3.1HIGH 7.5
  • TI-2024-11211 Rsync: path traversal vulnerability in rsync CVSS 3.1HIGH 7.5
See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences