Hackage - OSV

HSEC-2026-0010

Hackage/jwt

Improper parsing of fractional NumericDate from JWT exp claims 29 Sep

Fix available
Severity - 4.0 (Medium)

HSEC-2026-0008

Hackage/crypton-x509
Hackage/crypton-x509-validation
Hackage/x509
Hackage/x509-validation

crypton-x509-validation and crypton-x509 do not enforce X.509 Name Constraints 03 Jun

Fix available
Severity - 6.8 (Medium)

HSEC-2026-0007

Hackage/aeson
Hackage/text-iso8601

Denial of Service and Memory Exhaustion in aeson 22 May

Fix available
Severity - 7.5 (High)

HSEC-2026-0006

Hackage/Cabal

Cabal deletes project source files during configure 08 Apr

No fix available
Severity - 5.5 (Medium)

HSEC-2026-0004

Hackage/hackage-server

Hackage package metadata stored XSS vulnerability 28 Mar

No fix available
Severity - 9.9 (Critical)

HSEC-2026-0002

Hackage/hackage-server

Hackage CSRF vulnerability 28 Mar

No fix available
Severity - 9.6 (Critical)

HSEC-2024-0004

Hackage/hackage-server

Hackage package and doc upload stored XSS vulnerability 16 Jan

Fix available
Severity - 9.9 (Critical)

HSEC-2025-0007

Hackage/cmark-gfm

cmark-gfm: resource exhaustion due to quadratic complexity in parser 27 Dec 2025

Fix available
Severity - 7.5 (High)

HSEC-2025-0006

Hackage/crypton-x509-store
Hackage/x509-store

Private key leak via inherited file descriptor 17 Nov 2025

Fix available
Severity - 5.3 (Medium)

HSEC-2023-0001

Hackage/aeson

Hash flooding vulnerability in aeson 14 Nov 2025

Fix available
Severity - 6.5 (Medium)

HSEC-2023-0002

Hackage/biscuit-haskell

Improper Verification of Cryptographic Signature 14 Nov 2025

Fix available
Severity - 9.8 (Critical)

HSEC-2023-0003

Hackage/xmonad-contrib

code injection in xmonad-contrib 14 Nov 2025

Fix available
Severity - 7.5

HSEC-2023-0004

Hackage/xml-conduit

xml-conduit unbounded entity expansion 14 Nov 2025

Fix available
Severity - 7.5 (High)

HSEC-2023-0005

Hackage/tls-extra

tls-extra: certificate validation does not check Basic Constraints 14 Nov 2025

Fix available
Severity - 9.1 (Critical)

HSEC-2023-0006

Hackage/x509-validation

x509-validation does not enforce pathLenConstraint 14 Nov 2025

Fix available
Severity - 5.7 (Medium)

HSEC-2023-0007

Hackage/base
Hackage/toml-reader

readFloat: memory exhaustion with large exponent 14 Nov 2025

Fix available
Severity - 7.5 (High)

Vulnerabilities