-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
RustRust| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nix | rust | >= 0.16.0, < 0.20.2 | 0.20.2 |
| nix | rust | >= 0.21.0, < 0.21.2 | 0.21.2 |
| nix | rust | >= 0.22.0, < 0.22.2 | 0.22.2 |
Miggo AIRoot Cause AnalysisThe vulnerability explicitly occurs in nix's getgrouplist() implementation as described in CVE/GHSA details. The root cause is the mismatch between buffer capacity and ngroups value passed to libc after buffer resizing. The function's retry logic (doubling buffer without updating ngroups) directly matches the vulnerability description. Multiple independent sources (GitHub advisory, RustSec, and original issue) all point to this specific function as the vulnerable component.
Ongoing coverage of React2Shell