p PatchFirst

CVE-2026-44028

CVE-2026-44028

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An issue was discovered in Nix before 2.34.7 and Lix before 2.95.2. Unbounded recursion in the NAR (Nix Archive) parser could lead to a stack-to-heap overflow when the parser is run on a coroutine stack. The stack is allocated without a guard page, which means that a stack overflow could overwrite memory on the heap and could allow arbitrary code execution as the Nix daemon (run as root in multi-user installations) if ASLR hardening is bypassed. This can be exploited by all users able to connect to the daemon (e.g., in Nix, this is configurable via the allowed-users setting, defaulting to all users). The fixed versions are 2.34.7, 2.33.6, 2.32.8, 2.31.5, 2.30.5, 2.29.4, and 2.28.7 for Nix (introduced in 2.24.4); and 2.95.2, 2.94.2, and 2.93.4 for Lix (introduced in 2.93.0).

CVSS 7.5 · High · EPSS 0.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • nix

    Versions
    • ≥ 2.24.4, < 2.28.7: Affected (semver)
    • ≥ 2.29.0, < 2.29.4: Affected (semver)
    • ≥ 2.30.0, < 2.30.5: Affected (semver)
    • ≥ 2.31.0, < 2.31.5: Affected (semver)
    • ≥ 2.32.0, < 2.32.8: Affected (semver)
    • ≥ 2.33.0, < 2.33.6: Affected (semver)
    • ≥ 2.34.0, < 2.34.7: Affected (semver)

    Update to 2.28.7; Update to 2.29.4; Update to 2.30.5; Update to 2.31.5; Update to 2.32.8; Update to 2.33.6; Update to 2.34.7

  • lix

    Versions
    • ≥ 2.93.0, < 2.93.4: Affected (semver)
    • ≥ 2.94.0, < 2.94.2: Affected (semver)
    • ≥ 2.95.0, < 2.95.2: Affected (semver)

    Update to 2.93.4; Update to 2.94.2; Update to 2.95.2

  • nix Debian:13

    Versions
    • 2.26.3+dfsg-1
    • 2.32.5+dfsg-1
    • 2.32.5+dfsg-2
    • 2.34.3+dfsg-1
    • 2.34.6+dfsg-1
    • 2.34.8+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nix Debian:14

    Versions
    • 2.26.3+dfsg-1
    • 2.32.5+dfsg-1
    • 2.32.5+dfsg-2
    • 2.34.3+dfsg-1
    • 2.34.6+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 2.34.8+dfsg-1

    Update to 2.34.8+dfsg-1

  • nix Ubuntu:Pro:22.04:LTS

    Versions
    • 2.3.10+dfsg1-1
    • 2.3.10+dfsg1-1build1
    • 2.6.0+dfsg-2
    • 2.6.0+dfsg-3
    • 2.6.0+dfsg-3ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nix Ubuntu:Pro:24.04:LTS

    Versions
    • 2.16.1+dfsg-3ubuntu1
    • 2.18.1+dfsg-1ubuntu1
    • 2.18.1+dfsg-1ubuntu2
    • 2.18.1+dfsg-1ubuntu4
    • 2.18.1+dfsg-1ubuntu5
    • 2.18.1+dfsg-1ubuntu5+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nix Ubuntu:25.10

    Versions
    • 2.24.9+dfsg-2ubuntu2
    • 2.26.3+dfsg-1ubuntu1
    • 2.26.3+dfsg-1ubuntu2
    • 2.26.3+dfsg-1ubuntu4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nix Ubuntu:26.10

    Versions
    • 2.34.3+dfsg-1
    • 2.34.6+dfsg-1
    • 2.34.6+dfsg-1build1
    • 2.34.8+dfsg-1
    • 2.34.8+dfsg-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nix Ubuntu:26.04:LTS

    Versions
    • 2.26.3+dfsg-1ubuntu4
    • 2.26.3+dfsg-1ubuntu5
    • 2.32.5+dfsg-1ubuntu3
    • 2.32.5+dfsg-2ubuntu1
    • 2.34.3+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →